---
- name: Install HTTPD and Utils
  ansible.builtin.dnf:
    name:
      - httpd
      - mod_ssl
      - policycoreutils-python-utils
      - firewalld
      - rpm-build
      - rpmdevtools
      - wget
      - git # Kept for utility, though not serving repos
    state: present

- name: Create dist-git group
  ansible.builtin.group:
    name: "{{ dist_git_group }}"
    state: present

- name: Create dist-git user
  ansible.builtin.user:
    name: "{{ dist_git_user }}"
    group: "{{ dist_git_group }}"
    home: "{{ dist_git_base_dir }}"
    create_home: true
    shell: /bin/bash
    state: present

- name: Create dist-git directory structure
  ansible.builtin.file:
    path: "{{ item }}"
    state: directory
    owner: "{{ dist_git_user }}"
    group: "{{ dist_git_group }}"
    mode: "0755"
  loop:
    - "{{ dist_git_base_dir }}"
    - "{{ dist_git_repos_dir }}"
    - "{{ dist_git_repos_dir }}/RPMs"
    - "{{ dist_git_cache_dir }}"

- name: Set SELinux boolean for HTTPD CGI support
  ansible.builtin.command: setsebool -P httpd_enable_cgi 1
  changed_when: false

- name: Set SELinux context for dist-git directories (persistent)
  ansible.builtin.command: semanage fcontext -a -t httpd_sys_content_t "{{ dist_git_base_dir }}(/.*)?"
  changed_when: false

- name: Apply SELinux context for dist-git directories
  ansible.builtin.command: restorecon -R -v {{ dist_git_base_dir }}
  changed_when: false

- name: Create PKI directory for Dist-Git
  ansible.builtin.file:
    path: /etc/pki/dist-git
    state: directory
    owner: root
    group: root
    mode: "0755"

- name: Copy Dist-Git certificates
  ansible.builtin.copy:
    src: "{{ koji_pki_dir }}/{{ item.src }}"
    dest: "/etc/pki/dist-git/{{ item.dest }}"
    mode: "{{ item.mode }}"
  loop:
    - { src: "dist-git.crt", dest: "dist-git.crt", mode: "0644" }
    - { src: "dist-git.key", dest: "dist-git.key", mode: "0600" }
  notify: Restart httpd

- name: Configure HTTPD for dist-git
  ansible.builtin.template:
    src: dist-git.conf.j2
    dest: "{{ dist_git_httpd_conf_path }}"
    owner: root
    group: root
    mode: "0644"
  notify: Restart httpd

- name: Ensure firewalld is running
  ansible.builtin.service:
    name: firewalld
    state: started
    enabled: true

- name: Allow HTTP/HTTPS service in firewall
  ansible.builtin.firewalld:
    service: "{{ item }}"
    permanent: true
    state: enabled
    immediate: true
  loop:
    - http
    - https

- name: Ensure HTTPD is enabled and started
  ansible.builtin.service:
    name: httpd
    state: started
    enabled: true