---
# file: roles/nfs-server/tasks/main.yml

- name: ensure nfs server utils are installed
  apt:
    name:
      - nfs-common
      - nfs-kernel-server
      - msktutil
      - librpcsecgss3
      - libgssrpc4
    state: present
  tags:
    - nfs-server

- name: ensure default umask and other user related stuff
  copy:
    src: login.defs
    dest: /etc/login.defs
    owner: root
    group: root
    mode: '0644'
  tags:
    - nfs-server
    - umask

- name: ensure exports configuration is in place
  template:
    src: exports.j2
    dest: /etc/exports
    owner: root
    group: root
    mode: '0644'
  notify:
    - restart nfs-server
  tags:
    - nfs-server

- name: ensure nfs-common is configured
  copy:
    src: nfs-common
    dest: /etc/default/nfs-common
    owner: root
    group: root
    mode: '0644'
  notify:
    - restart nfs-server
  tags:
    - nfs-server

- name: ensure nfs-kernel-server is configured
  copy:
    src: nfs-kernel-server
    dest: /etc/default/nfs-kernel-server
    owner: root
    group: root
    mode: '0644'
  notify:
    - restart nfs-server
  tags:
    - nfs-server

- name: ensure nfs-server is enabled and running
  service:
    name: nfs-server
    state: started
    enabled: true
  tags:
    - nfs-server

- name: ensure that there is a keytab available
  file:
    path: /etc/krb5.keytab
    state: file
  tags:
    - nfs-server
    - service-principal
  when: nfs_krb is defined

- name: check that we have a valid service principal
  shell: |
    set -o pipefail
    klist -k /etc/krb5.keytab | grep "nfs/{{ ansible_fqdn }}"
  args:
    executable: /bin/bash
  register: principal
  failed_when: false
  tags:
    - nfs-server
    - service-principal
  when: nfs_krb is defined

- block:
    - name: create service principal
      # yamllint disable-line rule:line-length
      command: samba-tool spn add "nfs/{{ ansible_fqdn }}" "{{ ansible_hostname | upper }}$"
      delegate_to: "{{ hostvars[groups['servers_ad'][0]]['ansible_host'] }}"
      tags:
        - nfs-server
        - service-principal

    - name: export keytab
      # yamllint disable-line rule:line-length
      command: samba-tool domain exportkeytab "/root/{{ ansible_fqdn }}.keytab" --principal "nfs/{{ ansible_fqdn }}"
      args:
        creates: "/root/{{ ansible_fqdn }}.keytab"
      delegate_to: "{{ hostvars[groups['servers_ad'][0]]['ansible_host'] }}"
      tags:
        - nfs-server
        - service-principal

    - name: copy keytab
      synchronize:
        src: "/root/{{ ansible_fqdn }}.keytab"
        dest: "/root/{{ ansible_fqdn }}.keytab"
      delegate_to: "{{ hostvars[groups['servers_ad'][0]]['ansible_host'] }}"
      tags:
        - nfs-server
        - service-principal

    - name: ensure pexpect is installed
      apt:
        name: python-pexpect
        state: present
      tags:
        - nfs-server
        - service-principal

    - name: merge keytabs
      expect:
        command: ktutil
        responses:
          ktutil(.*):
            - rkt /etc/krb5.keytab
            - "rkt /root/{{ ansible_fqdn }}.keytab"
            - wkt /etc/krb5.keytab
            - exit
      notify:
        - restart nfs-server
      tags:
        - nfs-server
        - service-principal

    - name: remove keytab at kdc
      file:
        path: "/root/{{ ansible_fqdn }}.keytab"
        state: absent
      delegate_to: "{{ hostvars[groups['servers_ad'][0]]['ansible_host'] }}"
      tags:
        - nfs-server
        - service-principal

    - name: remove keytab at host
      file:
        path: "/root/{{ ansible_fqdn }}.keytab"
        state: absent
      tags:
        - nfs-server
        - service-principal
  when: principal.rc == 1 and nfs_krb is defined

- meta: flush_handlers
