---

- name: Enable CodeReady Builder (CRB) repository
  ansible.builtin.command: dnf config-manager --set-enabled crb
  args:
    creates: /etc/yum.repos.d/centos-stream-crb.repo

- name: Install EPEL repository
  ansible.builtin.dnf:
    name: epel-release
    state: present

- name: Install Koji-Builder packages, rpm-build, and koji CLI
  ansible.builtin.dnf:
    name:
      - koji-builder
      - rpm-build
      - rpmdevtools
      - mock
      - policycoreutils-python-utils
      - git
      - koji
    state: present

- name: Create kojid work directory
  ansible.builtin.file:
    path: /var/lib/kojid
    state: directory
    owner: root
    group: root
    mode: "0755"

- name: Ensure kojibuilder user exists and is in the mock group
  ansible.builtin.user:
    name: kojibuilder
    groups: mock
    state: present

- name: Ensure system user kojid is in the mock group
  ansible.builtin.user:
    name: kojid
    groups: mock
    append: true
    state: present

- name: Ensure /etc/mock/koji has correct permissions
  ansible.builtin.file:
    path: /etc/mock/koji
    state: directory
    owner: root
    group: mock
    mode: "2775"



- name: Configure kojid
  ansible.builtin.template:
    src: kojid.conf.j2
    dest: /etc/kojid/kojid.conf
    mode: "0644"
  notify: Restart kojid

- name: Ensure /etc/pki/koji directory exists
  ansible.builtin.file:
    path: /etc/pki/koji
    state: directory
    owner: root
    group: root
    mode: "0755"

- name: Copy Koji certificates to the builder
  ansible.builtin.copy:
    src: "{{ koji_pki_dir }}/{{ item.src }}"
    dest: "{{ item.dest }}"
    owner: root
    group: root
    mode: "{{ item.mode }}"
  loop:
    - {src: "{{ koji_ca_name }}_cert.crt", dest: "{{ koji_remote_ca_trust_path }}", mode: "0644"}
    - {src: "kojid.crt", dest: "{{ kojid_crt_path }}", mode: "0644"}
    - {src: "kojid.key", dest: "{{ kojid_key_path }}", mode: "0600"}

- name: "Concatenate certificate and key into a PEM file"
  ansible.builtin.shell: cat "{{ kojid_crt_path }}" "{{ kojid_key_path }}" > "{{ kojid_pem_path }}"
  args:
    creates: "{{ kojid_pem_path }}"

- name: Set ownership and permissions on kojid.pem
  ansible.builtin.file:
    path: "{{ kojid_pem_path }}"
    owner: root
    group: root
    mode: "0600"

- name: Configure Koji client on builder
  ansible.builtin.template:
    src: roles/koji_hub/templates/koji.conf.j2
    dest: /etc/koji.conf.d/ansible-settings.conf
    mode: "0644"


- name: Add hub host to /etc/hosts
  ansible.builtin.lineinfile:
    path: /etc/hosts
    line: "{{ hostvars[groups['kojihub'][0]].ansible_default_ipv4.address }} {{ koji_hub_fqdn }}"
    regexp: ".*{{ koji_hub_fqdn }}"
    state: present

- name: Copy source fetching wrapper script
  ansible.builtin.copy:
    src: mxos-get-sources.bash
    dest: "{{ koji_source_script_path }}"
    mode: "0755"
    owner: root
    group: root

- name: Configure global Mock bind mount for get-sources script
  ansible.builtin.blockinfile:
    path: /etc/mock/site-defaults.cfg
    block: |
      # Bind mount the MxOS source fetching wrapper globally
      config_opts['plugin_conf']['bind_mount_enable'] = True
      config_opts['plugin_conf']['bind_mount_opts'] = {'dirs': [('/usr/local/bin/mxos-get-sources.bash', '/usr/local/bin/mxos-get-sources.bash')]}
    marker: "# {mark} ANSIBLE MANAGED BLOCK: MXOS BIND MOUNT"

- name: Configure MxOS Mock config
  ansible.builtin.template:
    src: mxos0-build-x86_64.cfg.j2
    dest: /etc/mock/mxos0-build-x86_64.cfg
    mode: "0644"
    owner: root
    group: mock

- name: Update CA trust
  ansible.builtin.command: update-ca-trust
  changed_when: false
  check_mode: false

- name: Start and enable kojid service
  ansible.builtin.service:
    name: kojid
    state: started
    enabled: true