---

- name: install soju
  become: yes
  apt: name="soju"
  notify: restart soju

- name: install soju db schema file
  become: yes
  template:
    src: "setup_db.psql.j2"
    dest: "/tmp/setup_db_soju.psql"
    owner: "postgres"
    group: "postgres"
    mode: "0600"

- name: setup soju db
  become: yes
  become_user: "postgres"
  command: "psql -f /tmp/setup_db_soju.psql"
  changed_when: false

- name: create soju data dir
  become: yes
  file:
    path: "{{soju_data_dir}}"
    state: "directory"
    owner: "{{soju_user}}"
    group: "{{soju_user}}"
    mode: "0755"

- name: configure soju
  become: yes
  template:
    src: "config.j2"
    dest: "/etc/soju/config"
    mode: "0644"
  notify: restart soju

# The packaged unit only orders after network-online; without postgres
# ordering soju races the postgres socket at boot and stays failed.
- name: create soju service override dir
  become: yes
  file:
    path: "/etc/systemd/system/soju.service.d"
    state: "directory"
    mode: "0755"

- name: order soju after postgresql
  become: yes
  copy:
    dest: "/etc/systemd/system/soju.service.d/override.conf"
    mode: "0644"
    content: |
      [Unit]
      After=postgresql.service
  notify: restart soju

- name: enable soju service
  become: yes
  systemd: name="soju.service" enabled="yes" state="started" daemon_reload="yes"

- name: flush handlers to ensure soju is restarted with latest config
  meta: flush_handlers

# stdin instead of an echo pipeline: /bin/sh is dash, whose echo interprets
# backslash escapes and silently mangles passwords containing them.
- name: create soju admin user
  become: yes
  become_user: "{{soju_user}}"
  command: "sojudb -config /etc/soju/config create-user {{soju_admin_user}} -admin"
  args:
    stdin: "{{soju_admin_password}}"
  register: soju_create_user
  changed_when: soju_create_user.rc == 0
  failed_when: soju_create_user.rc != 0 and 'duplicate key' not in soju_create_user.stderr
  no_log: true
  notify: restart soju

# The vault is the only source of truth for this password (no in-band IRC
# changes), so re-apply whenever it differs from what was last applied,
# rather than requiring a manually-passed flag that's easy to forget after
# a vault rotation (soju kept authenticating against a pre-rotation
# password for 7 months because of exactly that - nothing ever set the
# flag). The marker tracks a hash, not the password itself, so re-running
# with an unchanged password is a no-op and doesn't restart (and
# disconnect) a live bouncer.
- name: track applied soju admin password
  become: yes
  copy:
    content: "{{ soju_admin_password | hash('sha256') }}"
    dest: "/etc/soju/.admin_password_applied"
    mode: "0600"
  register: soju_password_marker
  no_log: true

# sojudb writes the database behind the running daemon's back and soju
# authenticates against its in-memory copy, so the restart notify is what
# makes the new password actually take effect.
- name: update soju admin password
  become: yes
  become_user: "{{soju_user}}"
  command: "sojudb -config /etc/soju/config change-password {{soju_admin_user}}"
  args:
    stdin: "{{soju_admin_password}}"
  no_log: true
  when: soju_password_marker is changed
  notify: restart soju

- name: install nginx stream config
  become: yes
  template:
    src: "nginx-stream.conf.j2"
    dest: "/etc/nginx/streams-available/soju.conf"
  notify: reload nginx

- name: enable nginx stream config
  become: yes
  file:
    src: "/etc/nginx/streams-available/soju.conf"
    dest: "/etc/nginx/streams-enabled/soju.conf"
    state: "link"
  notify: reload nginx