---
- name: install packages
  package:
    name: "{{ item }}"
    state: installed
  with_items:
    - krb5-server
    - krb5-server-ldap
    - python-kdcproxy

- name: create kerberos config
  template:
    dest: /var/kerberos/krb5kdc/kdc.conf
    src: kdc.conf.j2
    mode: 0600
    owner: root
    group: "{{ ansible_wheel }}"
  notify: restart kdc

- name: store kdc and kadmin ldap auth credentials
  shell: "( echo '{{ kerberos_kdc_pass }}' ; echo '{{ kerberos_kdc_pass }}' ) | kdb5_ldap_util stashsrvpw uid=krb5kdc,cn={{ kerberos_realm }},ou=System,{{ ldap_basedn }} ; ( echo '{{ kerberos_kadmin_pass }}' ; echo '{{ kerberos_kadmin_pass }}' ) | kdb5_ldap_util stashsrvpw uid=krb5kadmin,cn={{ kerberos_realm }},ou=System,{{ ldap_basedn }}"
  args:
    creates: "/var/kerberos/krb5kdc/.k5.ldap.{{ kerberos_realm|lower() }}"
  no_log: true

- name: store kdc master key
  shell: "echo '{{ kerberos_master_pass }}' | kdb5_util stash"
  args:
    creates: "/var/kerberos/krb5kdc/.k5.{{ kerberos_realm }}"
  no_log: true

- name: enable kerberos service
  service:
    name: krb5kdc
    state: started
    enabled: true

- name: create kdcproxy group
  group:
    name: kdcproxy
    system: true

- name: create kdcproxy user
  user:
    name: kdcproxy
    comment: KDC Proxy
    group: kdcproxy
    groups: gunicorn
    home: /var/empty
    shell: /sbin/nologin
    system: true

- name: add nginx to kdcproxy group
  user:
    name: nginx
    groups: kdcproxy

- name: create kdcproxy config
  template:
    dest: /etc/kdcproxy.conf
    src: kdcproxy.conf.j2
    mode: 0644
    owner: root
    group: "{{ ansible_wheel }}"

- name: create kdcproxy socket file
  copy:
    dest: /lib/systemd/system/gunicorn@kdcproxy.socket
    src: /lib/systemd/system/gunicorn@.socket
    mode: 0644
    owner: root
    group: "{{ ansible_wheel }}"
    remote_src: true

- name: enable kdcproxy socket
  systemd:
    name: gunicorn@kdcproxy.socket
    enabled: true
    state: started

- name: create kdcproxy config for nginx
  template:
    dest: "/etc/nginx/conf.d/{{ inventory_hostname }}/kdcproxy.conf"
    src: nginx-kdcproxy.conf.j2
    mode: 0644
    owner: root
    group: "{{ ansible_wheel }}"
  notify: restart nginx