---
- name: Install sigul-pesign-bridge package
  ansible.builtin.package:
    state: present
    name: sigul-pesign-bridge
  tags:
    - packages
    - siguldry
    - siguldry/pesign_bridge

- name: Install sbverify package
  ansible.builtin.package:
    state: present
    name: sbsigntools
  when: siguldry_pesign_bridge_install_sbverify | default(true)
  tags:
    - packages
    - siguldry
    - siguldry/pesign_bridge

- name: Create sigul-pesign-bridge config directory
  ansible.builtin.file:
    path: /etc/sigul-pesign-bridge
    state: directory
    owner: root
    group: root
    mode: '0755'
  tags:
    - config
    - siguldry
    - siguldry/pesign_bridge

- name: Create credstore.encrypted directory
  ansible.builtin.file:
    path: /etc/credstore.encrypted
    state: directory
    owner: root
    group: root
    mode: '0700'
  tags:
    - config
    - siguldry
    - siguldry/pesign_bridge

- name: Setup sigul-pesign-bridge config file
  ansible.builtin.template:
    src: config.toml.j2
    dest: /etc/sigul-pesign-bridge/config.toml
    owner: root
    group: root
    mode: '0644'
  notify: restart sigul-pesign-bridge
  tags:
    - config
    - siguldry
    - siguldry/pesign_bridge

- name: Create pesign group
  ansible.builtin.group:
    name: pesign
    state: present
  tags:
    - users
    - siguldry
    - siguldry/pesign_bridge

- name: Add users to pesign group
  ansible.builtin.user:
    name: "{{ item }}"
    groups: pesign
    append: yes
  loop: "{{ siguldry_pesign_bridge_users | default([]) }}"
  when: siguldry_pesign_bridge_users is defined
  tags:
    - users
    - siguldry
    - siguldry/pesign_bridge

- name: Setup client certificate
  ansible.builtin.copy:
    src: "{{ private }}"/files/sigulca/production/pki/issued/sigul-pesign-bridge.crt
    dest: /etc/sigul-pesign-bridge/client.crt
    owner: root
    group: root
    mode: '0644'
  tags:
    - config
    - siguldry
    - siguldry/pesign_bridge

- name: Setup CA certificate
  ansible.builtin.copy:
    src: "{{ private }}"/files/sigulca/production/pki/ca.crt
    dest: /etc/sigul-pesign-bridge/ca.crt
    owner: root
    group: root
    mode: '0644'
  tags:
    - config
    - siguldry
    - siguldry/pesign_bridge

- name: Enable and start sigul-pesign-bridge service
  ansible.builtin.systemd:
    name: sigul-pesign-bridge.service
    enabled: yes
    state: started
    daemon_reload: yes
  tags:
    - services
    - siguldry
    - siguldry/pesign_bridge

- name: Mock site-defaults.cfg for pesign builders.
  ansible.builtin.template:
    src: pesign-builder-site-defaults.cfg.j2
    dest: /etc/mock/site-defaults.cfg
    mode: "0644"
    owner: root
    group: mock
  tags:
    - services
    - siguldry
    - siguldry/pesign_bridge