---
- name: Set platform/version specific variables
  include_tasks: set_vars.yml

- name: Install session recording packages
  package:
    name: "{{ __tlog_packages }}"
    use: "{{ (__tlog_is_ostree | d(false)) |
             ternary('ansible.posix.rhel_rpm_ostree', omit) }}"

- name: Get the rpm package facts
  package_facts:

- name: Install cockpit session recording
  package:
    name: "{{ __tlog_cockpit_packages }}"
    use: "{{ (__tlog_is_ostree | d(false)) |
             ternary('ansible.posix.rhel_rpm_ostree', omit) }}"
  when:
    - "'cockpit' in ansible_facts.packages"

- name: Configure sssd services section
  community.general.ini_file:
    path: "{{ __tlog_sssd_conf }}"
    section: sssd
    option: "{{ item.key }}"
    value: "{{ item.value }}"
    state: present
    create: true
    owner: root
    group: root
    mode: "0600"
  loop:
    - key: services
      value: "nss, pam"
    - key: domains
      value: "nssfiles"
  when:
    - tlog_use_sssd | bool
    - "'sssd' in ansible_facts.packages"
  notify: Handler tlog_handler restart sssd

- name: Configure sssd proxy provider domain
  community.general.ini_file:
    path: "{{ __tlog_sssd_conf }}"
    section: domain/nssfiles
    option: "{{ item.key }}"
    value: "{{ item.value }}"
    state: present
    create: true
    owner: root
    group: root
    mode: "0600"
  loop:
    - key: id_provider
      value: proxy
    - key: proxy_lib_name
      value: files
    - key: proxy_pam_target
      value: sssd-shadowutils
  when:
    - tlog_use_sssd | bool
    - "'sssd' in ansible_facts.packages"
  notify: Handler tlog_handler restart sssd

- name: Configure sssd session recording config
  template:
    src: sssd-session-recording.conf
    dest: "{{ __tlog_sssd_session_recording_conf }}"
    owner: root
    group: root
    mode: "0600"
  when: tlog_use_sssd
  notify: Handler tlog_handler restart sssd

- name: Check appropriate authselect features exists
  command: authselect list-features sssd
  register: __tlog_authselect_features
  changed_when: false

- name: Enable authselect profile with tlog feature
  command: authselect select sssd with-tlog --force
  changed_when: true
  when:
    - not ansible_check_mode
    - tlog_use_sssd | bool
    - '"with-tlog" in __tlog_authselect_features.stdout'

- name: Check which authselect features are currently enabled
  command: authselect current
  register: __tlog_authselect_current
  changed_when: false
  failed_when: __tlog_authselect_current.rc not in [0, 2]

- name: Update nsswitch
  command: authselect select sssd with-files-domain --force
  when:
    - not ansible_check_mode
    - tlog_use_sssd
    - '"with-files-domain" in __tlog_authselect_features.stdout'
    - not "with-files-domain" in __tlog_authselect_current.stdout
  notify: Handler tlog_handler restart sssd
  changed_when: true

- name: Configure tlog rec session
  template:
    src: tlog-rec-session.conf
    dest: "{{ __tlog_rec_session_conf }}"
    owner: root
    group: root
    mode: "0644"
