---
- name: Ensure tang is installed
  package:
    name: "{{ __nbde_server_packages }}"
    state: present
    use: "{{ (__nbde_server_is_ostree | d(false)) |
             ternary('ansible.posix.rhel_rpm_ostree', omit) }}"

- name: Ensure keys are rotated
  when: nbde_server_rotate_keys | bool
  nbde_server_tang:
    state: keys-rotated
    keygen: "{{ __nbde_server_keygen }}"
    keydir: "{{ __nbde_server_keydir }}"
    update: "{{ __nbde_server_update }}"
    cachedir: "{{ __nbde_server_cachedir }}"

- name: Ensure we have keys
  when: not (nbde_server_rotate_keys | bool)
  nbde_server_tang:
    state: keys-created
    keygen: "{{ __nbde_server_keygen }}"
    keydir: "{{ __nbde_server_keydir }}"
    update: "{{ __nbde_server_update }}"
    cachedir: "{{ __nbde_server_cachedir }}"

- name: Perform key management (fetch/deploy) tasks
  when: (nbde_server_fetch_keys | bool) or
        (nbde_server_deploy_keys | bool)
  include_tasks: tang-key-management.yml

- name: Manage firewall and SELinux for port
  include_tasks: tangd-custom-port.yml

# This tasks reload the daemons so the new changes take effect
- name: Reload the daemons so the new changes take effect
  systemd:
    daemon_reload: true
  when: __nbde_server_port_changed | d(false) | bool

- name: Ensure required services are enabled and at the right state
  service:
    name: "{{ item }}"
    state: "{{ __state }}"
    enabled: true
  loop: "{{ __nbde_server_services }}"
  vars:
    __state: "{{ nbde_server_service_state if
      nbde_server_service_state != 'started' else
      'restarted' if __nbde_server_port_changed else
      'started' }}"

## vim:set ts=2 sw=2 et:
