---
- name: install packages
  package:
    name: "{{ item }}"
    state: installed
  with_items:
    - krb5-server
    - krb5-server-ldap

- name: create kerberos config
  template:
    dest: /var/kerberos/krb5kdc/kdc.conf
    src: kdc.conf.j2
    mode: 0600
    owner: root
    group: "{{ ansible_wheel }}"
  notify: restart kdc

- name: store ldap auth credentials
  shell: "( echo '{{ kerberos_kdc_pass }}' ; echo '{{ kerberos_kdc_pass }}' ) | kdb5_ldap_util stashsrvpw uid=krb5kdc,cn={{ kerberos_realm }},ou=System,{{ ldap_basedn }}"
  args:
    creates: "/var/kerberos/krb5kdc/.k5.ldap.{{ kerberos_realm|lower() }}"
  no_log: true

- name: store kdc master key
  shell: "echo '{{ kerberos_master_pass }}' | kdb5_util stash"
  args:
    creates: "/var/kerberos/krb5kdc/.k5.{{ kerberos_realm }}"
  no_log: true

- name: enable kerberos service
  service:
    name: krb5kdc
    state: started
    enabled: true