---
- name: "Generate: Siguldry Certificates on Localhost"
  delegate_to: localhost
  run_once: true
  block:
    - name: "Generate Siguldry CA private key"
      community.crypto.openssl_privatekey:
        path: "{{ koji_pki_dir }}/siguldry_ca.key"
        size: 4096
        mode: "0600"

    - name: "Generate Siguldry CA CSR"
      community.crypto.openssl_csr:
        path: "{{ koji_pki_dir }}/siguldry_ca.csr"
        privatekey_path: "{{ koji_pki_dir }}/siguldry_ca.key"
        common_name: "Siguldry Certificate Authority"
        organization_name: "MxOS Siguldry"
        basic_constraints:
          - "CA:TRUE"
        key_usage:
          - keyCertSign
          - cRLSign

    - name: "Generate self-signed Siguldry CA certificate"
      community.crypto.x509_certificate:
        path: "{{ koji_pki_dir }}/siguldry_ca.crt"
        csr_path: "{{ koji_pki_dir }}/siguldry_ca.csr"
        privatekey_path: "{{ koji_pki_dir }}/siguldry_ca.key"
        provider: selfsigned
        selfsigned_not_after: "+3650d"

    - name: "Generate private key for Siguldry Server"
      community.crypto.openssl_privatekey:
        path: "{{ koji_pki_dir }}/siguldry-server.key"
        size: 4096
        mode: "0600"

    - name: "Generate CSR for Siguldry Server"
      community.crypto.openssl_csr:
        path: "{{ koji_pki_dir }}/siguldry-server.csr"
        privatekey_path: "{{ koji_pki_dir }}/siguldry-server.key"
        common_name: "{{ koji_hub_fqdn }}"

    - name: Create openssl config for Siguldry Server
      ansible.builtin.copy:
        dest: "{{ koji_pki_dir }}/openssl-siguldry-server.cnf"
        mode: "0644"
        content: |
          [v3_ca]
          basicConstraints = CA:FALSE
          keyUsage = nonRepudiation, digitalSignature, keyEncipherment
          extendedKeyUsage = serverAuth, clientAuth
          subjectAltName = DNS:{{ koji_hub_fqdn }},DNS:server.example.com

    - name: Sign Siguldry Server certificate
      ansible.builtin.shell:
        cmd: >
          openssl x509 -req
          -in {{ koji_pki_dir }}/siguldry-server.csr
          -CA {{ koji_pki_dir }}/siguldry_ca.crt
          -CAkey {{ koji_pki_dir }}/siguldry_ca.key
          -CAcreateserial
          -out {{ koji_pki_dir }}/siguldry-server.crt
          -days 3650
          -sha256
          -extfile {{ koji_pki_dir }}/openssl-siguldry-server.cnf
          -extensions v3_ca
        creates: "{{ koji_pki_dir }}/siguldry-server.crt"

    - name: "Generate private key for Siguldry Bridge"
      community.crypto.openssl_privatekey:
        path: "{{ koji_pki_dir }}/siguldry-bridge.key"
        size: 4096
        mode: "0600"

    - name: "Generate CSR for Siguldry Bridge"
      community.crypto.openssl_csr:
        path: "{{ koji_pki_dir }}/siguldry-bridge.csr"
        privatekey_path: "{{ koji_pki_dir }}/siguldry-bridge.key"
        common_name: "{{ koji_hub_fqdn }}"

    - name: Create openssl config for Siguldry Bridge
      ansible.builtin.copy:
        dest: "{{ koji_pki_dir }}/openssl-siguldry-bridge.cnf"
        mode: "0644"
        content: |
          [v3_ca]
          basicConstraints = CA:FALSE
          keyUsage = nonRepudiation, digitalSignature, keyEncipherment
          extendedKeyUsage = serverAuth
          subjectAltName = DNS:{{ koji_hub_fqdn }},DNS:bridge.example.com

    - name: Sign Siguldry Bridge certificate
      ansible.builtin.shell:
        cmd: >
          openssl x509 -req
          -in {{ koji_pki_dir }}/siguldry-bridge.csr
          -CA {{ koji_pki_dir }}/siguldry_ca.crt
          -CAkey {{ koji_pki_dir }}/siguldry_ca.key
          -CAcreateserial
          -out {{ koji_pki_dir }}/siguldry-bridge.crt
          -days 3650
          -sha256
          -extfile {{ koji_pki_dir }}/openssl-siguldry-bridge.cnf
          -extensions v3_ca
        creates: "{{ koji_pki_dir }}/siguldry-bridge.crt"

    - name: "Generate private key for Siguldry Client"
      community.crypto.openssl_privatekey:
        path: "{{ koji_pki_dir }}/siguldry-client.key"
        size: 4096
        mode: "0600"

    - name: "Generate CSR for Siguldry Client"
      community.crypto.openssl_csr:
        path: "{{ koji_pki_dir }}/siguldry-client.csr"
        privatekey_path: "{{ koji_pki_dir }}/siguldry-client.key"
        common_name: "kojiadmin"

    - name: Create openssl config for Siguldry Client
      ansible.builtin.copy:
        dest: "{{ koji_pki_dir }}/openssl-siguldry-client.cnf"
        mode: "0644"
        content: |
          [v3_ca]
          basicConstraints = CA:FALSE
          keyUsage = nonRepudiation, digitalSignature, keyEncipherment
          extendedKeyUsage = clientAuth
          subjectAltName = DNS:kojiadmin

    - name: Sign Siguldry Client certificate
      ansible.builtin.shell:
        cmd: >
          openssl x509 -req
          -in {{ koji_pki_dir }}/siguldry-client.csr
          -CA {{ koji_pki_dir }}/siguldry_ca.crt
          -CAkey {{ koji_pki_dir }}/siguldry_ca.key
          -CAcreateserial
          -out {{ koji_pki_dir }}/siguldry-client.crt
          -days 3650
          -sha256
          -extfile {{ koji_pki_dir }}/openssl-siguldry-client.cnf
          -extensions v3_ca
        creates: "{{ koji_pki_dir }}/siguldry-client.crt"

    - name: Clean up temporary openssl configs
      ansible.builtin.file:
        path: "{{ item }}"
        state: absent
      loop:
        - "{{ koji_pki_dir }}/openssl-siguldry-server.cnf"
        - "{{ koji_pki_dir }}/openssl-siguldry-bridge.cnf"
        - "{{ koji_pki_dir }}/openssl-siguldry-client.cnf"

- name: Install Siguldry package
  ansible.builtin.dnf:
    name:
      - siguldry
      - siguldry-pkcs11
      - gnupg-pkcs11-scd
    state: present

- name: Ensure Siguldry config directory exists
  ansible.builtin.file:
    path: /etc/siguldry
    state: directory
    owner: root
    group: siguldry
    mode: "0750"

- name: Deploy Siguldry configuration files
  ansible.builtin.template:
    src: "{{ item.src }}"
    dest: "/etc/siguldry/{{ item.dest }}"
    owner: root
    group: siguldry
    mode: "0640"
  loop:
    - { src: "server.toml.j2", dest: "server.toml" }
    - { src: "bridge.toml.j2", dest: "bridge.toml" }
    - { src: "client.toml.j2", dest: "client.toml" }

- name: Ensure systemd credstore directory exists
  ansible.builtin.file:
    path: /etc/credstore
    state: directory
    owner: root
    group: root
    mode: "0700"

- name: Deploy Siguldry TLS credentials to systemd credstore
  ansible.builtin.copy:
    src: "{{ koji_pki_dir }}/{{ item.src }}"
    dest: "/etc/credstore/{{ item.dest }}"
    owner: root
    group: root
    mode: "0600"
  loop:
    - { src: "siguldry_ca.crt", dest: "siguldry.ca_certificate.pem" }
    - { src: "siguldry-server.crt", dest: "siguldry.server.certificate.pem" }
    - { src: "siguldry-server.key", dest: "siguldry.server.private_key.pem" }
    - { src: "siguldry-bridge.crt", dest: "siguldry.bridge.certificate.pem" }
    - { src: "siguldry-bridge.key", dest: "siguldry.bridge.private_key.pem" }
    - { src: "siguldry-client.crt", dest: "siguldry.client.certificate.pem" }
    - { src: "siguldry-client.key", dest: "siguldry.client.private_key.pem" }

- name: Deploy Siguldry signing key passphrase to systemd credstore
  ansible.builtin.copy:
    content: "{{ gpg_key_passphrase }}"
    dest: /etc/credstore/siguldry.signing_key.passphrase
    owner: root
    group: root
    mode: "0600"

- name: Start and enable Siguldry services
  ansible.builtin.systemd:
    name: "{{ item }}"
    state: started
    enabled: true
    daemon_reload: true
  loop:
    - siguldry-bridge.service
    - siguldry-server.service
    - siguldry-client-proxy.socket
    - siguldry-signer.socket

- name: Run Siguldry database migrations
  become: true
  become_user: siguldry
  ansible.builtin.command:
    cmd: siguldry-server -c /etc/siguldry/server.toml manage migrate
  register: siguldry_migration_result
  changed_when: "'No migrations to apply' not in siguldry_migration_result.stdout"

- name: Check if remote user kojiadmin exists in Siguldry
  become: true
  become_user: siguldry
  ansible.builtin.shell:
    cmd: siguldry-server -c /etc/siguldry/server.toml manage users list
  register: siguldry_users_list
  changed_when: false

- name: Add remote user kojiadmin to Siguldry database
  become: true
  become_user: siguldry
  ansible.builtin.command:
    cmd: siguldry-server -c /etc/siguldry/server.toml manage users create kojiadmin
  when: "'kojiadmin' not in siguldry_users_list.stdout"

- name: Check if mxos-signing-key exists in Siguldry
  become: true
  become_user: siguldry
  ansible.builtin.shell:
    cmd: siguldry-server -c /etc/siguldry/server.toml manage key list
  register: siguldry_keys_list
  changed_when: false

- name: Create mxos-signing-key in Siguldry
  become: true
  become_user: siguldry
  ansible.builtin.shell:
    cmd: >
      siguldry-server -c /etc/siguldry/server.toml manage key create
      kojiadmin mxos-signing-key
      --password-file <(echo "{{ gpg_key_passphrase }}")
  when: "'mxos-signing-key' not in siguldry_keys_list.stdout"

- name: Ensure GnuPG directory exists for root user
  ansible.builtin.file:
    path: /root/.gnupg
    state: directory
    owner: root
    group: root
    mode: "0700"

- name: Deploy GnuPG gpg-agent.conf for root user
  ansible.builtin.copy:
    dest: /root/.gnupg/gpg-agent.conf
    owner: root
    group: root
    mode: "0600"
    content: |
      scdaemon-program /usr/bin/gnupg-pkcs11-scd

- name: Deploy GnuPG gnupg-pkcs11-scd.conf for root user
  ansible.builtin.copy:
    dest: /root/.gnupg/gnupg-pkcs11-scd.conf
    owner: root
    group: root
    mode: "0600"
    content: |
      providers siguldry
      provider-siguldry-library /usr/lib64/pkcs11/libsiguldry_pkcs11.so

- name: Kill running gpg-agent to apply PKCS#11 configuration
  ansible.builtin.command: gpgconf --kill gpg-agent
  failed_when: false
  changed_when: false

- name: Check if Siguldry signing key is imported in root keyring
  ansible.builtin.command: gpg --list-keys koji@cs10-koji-00.mx-os
  register: siguldry_gpg_key_check
  failed_when: false
  changed_when: false

- name: Import Siguldry signing key into root keyring
  ansible.builtin.shell:
    cmd: >
      SIGULDRY_SOCKET=/run/siguldry-client-proxy/siguldry-client-proxy.socket
      CREDENTIALS_DIRECTORY=/etc/credstore
      siguldry-client --credentials-directory /etc/credstore -c /etc/siguldry/client.toml key get mxos-signing-key --certificates
      | gpg --import
  when: siguldry_gpg_key_check.rc != 0