# SPDX-License-Identifier: MIT
---
- name: Install and configure squid
  when:
    - lsr_rhc_test_data.proxy_noauth_hostname == "localhost"
  block:
    - name: Install packages for squid
      package:
        name:
          - squid
          - httpd-tools
        state: present
        use: "{{ __rhc_is_ostree |
                 ternary('ansible.posix.rhel_rpm_ostree', omit) }}"

    - name: Check the status of the backup of configuration
      stat:
        path: /etc/squid/squid.conf.BACKUP
      register: squid_conf_backup_stat

    - name: Backup the configuration
      copy:
        src: /etc/squid/squid.conf
        dest: /etc/squid/squid.conf.BACKUP
        remote_src: true
        mode: "0644"
      when:
        - not squid_conf_backup_stat.stat.exists

    - name: Copy the pristine configuration back
      copy:
        src: /etc/squid/squid.conf.BACKUP
        dest: /etc/squid/squid.conf
        remote_src: true
        mode: "0644"
      when:
        - squid_conf_backup_stat.stat.exists

    - name: Open the Candlepin port
      lineinfile:
        path: /etc/squid/squid.conf
        regexp: "^acl SSL_ports port {{ lsr_rhc_test_data.candlepin_port }}"
        insertbefore: "^acl Safe_ports "
        firstmatch: true
        line: >-
          acl SSL_ports port {{ lsr_rhc_test_data.candlepin_port }} # Candlepin

    - name: Set the shutdown lifetime
      lineinfile:
        path: /etc/squid/squid.conf
        regexp: "^shutdown_lifetime "
        line: "shutdown_lifetime 5 seconds"

    - name: Setup no authentication
      when:
        - not (authentication | d(false))
      block:
        - name: Set the port
          lineinfile:
            path: /etc/squid/squid.conf
            regexp: "^http_port "
            line: "http_port {{ lsr_rhc_test_data.proxy_noauth_port }}"

    - name: Setup authenticated
      when: authentication | d(false)
      block:
        - name: Create the new passwd file
          command:
            argv:
              - htpasswd
              - "-c"
              - "-b"
              - "-m"
              - /etc/squid/passwd
              - "{{ lsr_rhc_test_data.proxy_auth_username }}"
              - "{{ lsr_rhc_test_data.proxy_auth_password }}"
          changed_when: false

        - name: Set the port
          lineinfile:
            path: /etc/squid/squid.conf
            regexp: "^http_port "
            line: "http_port {{ lsr_rhc_test_data.proxy_auth_port }}"

        - name: Disable HTTP access allow
          lineinfile:
            path: /etc/squid/squid.conf
            regexp: "^http_access allow localnet$"
            state: absent

        - name: Insert initial auth config
          blockinfile:
            path: /etc/squid/squid.conf
            marker: "# {mark} ANSIBLE MANAGED BLOCK - auth"
            insertbefore: BOF
            # yamllint disable rule:line-length
            block: |
              auth_param basic program /usr/lib64/squid/basic_ncsa_auth /etc/squid/passwd
              auth_param basic children 5
              auth_param basic credentialsttl 1 minute
              auth_param basic realm squid realm
            # yamllint enable rule:line-length

        - name: Add authenticated acl
          lineinfile:
            path: /etc/squid/squid.conf
            regexp: "^acl authenticated "
            insertafter: "^acl Safe_ports "
            line: >-
              acl authenticated proxy_auth REQUIRED

        - name: Allow authenticated acl
          lineinfile:
            path: /etc/squid/squid.conf
            regexp: "^http_access allow authenticated"
            insertafter: "^http_access deny manager"
            line: >-
              http_access allow authenticated

    - name: Restart squid
      service:
        name: squid
        state: restarted
