---
- name: install cups packages
  package:
    name: cups
    state: installed

- name: create cups systemd override directory
  file:
    path: /etc/systemd/system/cups.service.d
    state: directory
    mode: 0755
    owner: root
    group: "{{ ansible_wheel }}"

- name: configure cups keytab location
  copy:
    dest: /etc/systemd/system/cups.service.d/keytab.conf
    content: "[Service]\nEnvironment=KRB5_KTNAME=FILE:/etc/cups/cups.keytab\n"
    mode: 0644
    owner: root
    group: "{{ ansible_wheel }}"

- name: enable gssapi authentication from cups
  lineinfile:
    path: /etc/cups/cupsd.conf
    regexp: "^DefaultAuthType .*"
    line: "DefaultAuthType Negotiate"
  notify: restart cups

- name: configure cups listen port
  lineinfile:
    path: /etc/cups/cupsd.conf
    regexp: "^Listen (.*:)?631"
    line: "Listen 631"
  notify: restart cups

- name: write all requests to cups access log
  lineinfile:
    path: /etc/cups/cupsd.conf
    line: "AccessLogLevel all"
    insertafter: "LogLevel warn"
  notify: restart cups

- name: disable printer advertisements
  lineinfile:
    path: /etc/cups/cupsd.conf
    regexp: "^BrowseLocalProtocols .*"
    line: "BrowseLocalProtocols none"
  notify: restart cups

- name: link private key
  file:
    dest: "/etc/cups/ssl/{{ inventory_hostname }}.key"
    src: "{{ tls_private }}/{{ inventory_hostname }}.key"
    state: link
    owner: root
    group: "{{ ansible_wheel }}"
    follow: false
    force: true
  notify: restart cups

- name: link certificate
  file:
    dest: "/etc/cups/ssl/{{ inventory_hostname }}.crt"
    src: "{{ tls_certs }}/{{ inventory_hostname }}.crt"
    state: link
    owner: root
    group: "{{ ansible_wheel }}"
    follow: false
    force: true
  notify: restart cups

- name: disable printer advertising
  lineinfile:
    path: /etc/cups/cupsd.conf
    regexp: "^Browsing .*"
    line: "Browsing No"
  notify: restart cups

- name: disable unauthenticated access from cups
  blockinfile:
    path: /etc/cups/cupsd.conf
    insertafter: "^<Location />"
    block: |
      AuthType Default
      Require user @foosh
  notify: restart cups

- name: configure cups admin group
  lineinfile:
    path: /etc/cups/cups-files.conf
    regexp: "^SystemGroup .*"
    line: "SystemGroup root sysadm"
  notify: restart cups

- name: add static files to cups web interface
  copy:
    dest: "/usr/share/cups/www/{{ item }}"
    src: "{{ item }}"
    mode: 0644
    owner: root
    group: "{{ ansible_wheel }}"
  with_items:
    - logo.png
    - local.css

- name: create custom header for cups web interface
  copy:
    dest: /usr/share/cups/templates/header.tmpl
    src: header.tmpl
    mode: 0644
    owner: root
    group: "{{ ansible_wheel }}"

- name: disable cups socket service
  systemd:
    name: cups.socket
    enabled: false
    state: stopped

- name: enable cups service
  service:
    name: cups
    enabled: true
    state: started