# SPDX-License-Identifier: MIT
---
- name: Set platform/version specific variables
  include_tasks: set_vars.yml

- name: Gather the package facts
  package_facts:
  no_log: true

- name: Enable copr if requested
  include_tasks: enable_copr.yml
  when: podman_use_copr | d(false)

- name: Ensure required packages are installed
  package:
    name: "{{ __podman_packages }}"
    state: present
    use: "{{ (__podman_is_ostree | d(false)) |
             ternary('ansible.posix.rhel_rpm_ostree', omit) }}"
  become: true
  when: (__podman_packages | difference(ansible_facts.packages))
  register: podman_package_result

- name: Handle reboot for transactional update systems
  when:
    - __podman_is_transactional | d(false)
    - podman_package_result is changed
  block:
    - name: Notify user that reboot is needed to apply changes
      debug:
        msg: >
          Reboot required to apply changes due to transactional updates.

    - name: Reboot transactional update systems
      reboot:
        msg: Rebooting the system to apply transactional update changes.
      when: podman_transactional_update_reboot_ok | bool

    - name: Fail if reboot is needed and not set
      fail:
        msg: >
          Reboot is required but not allowed. Please set
          'podman_transactional_update_reboot_ok' to proceed.
      when:
        - podman_transactional_update_reboot_ok is none

- name: Get podman version
  check_mode: false
  command: podman --version
  changed_when: false
  register: __podman_version_output

- name: Set podman version
  set_fact:
    podman_version: "{{ (__podman_version_output.stdout.split())[2] }}"

- name: Podman package version must be 4.2 or later
  fail:
    msg: >
      podman package version {{ podman_version }} is too old -
      must be 4.2 or later
  when: podman_version is version("4.2", "<")

- name: Podman package version must be 4.4 or later for quadlet, secrets
  fail:
    msg: >
      podman package version {{ podman_version }} is too old -
      must be 4.4 or later to use quadlet or secrets
  when:
    - (podman_quadlet_specs | length > 0) or (podman_secrets | length > 0)
    - podman_version is version("4.4", "<")
    - podman_fail_if_too_old | d(true)

- name: Podman package version must be 4.4 or later for quadlet, secrets
  meta: end_host
  when:
    - (podman_quadlet_specs | length > 0) or (podman_secrets | length > 0)
    - podman_version is version("4.4", "<")
    - not podman_fail_if_too_old | d(true)

- name: Podman package version must be 5.0 or later for Pod quadlets
  fail:
    msg: >
      podman package version {{ podman_version }} is too old -
      must be 5.0 or later to use Pod quadlets
  when:
    - __has_type_pod or __has_pod_file_ext or __has_pod_file_src_ext or
      __has_pod_template_src_ext or __has_pod_template_src_ext_j2
    - podman_version is version("5.0", "<")
    - podman_fail_if_too_old | d(true)
  vars:
    __has_type_pod: "{{ podman_quadlet_specs | selectattr('type', 'defined') |
      selectattr('type', 'match', '^pod$') | list | length > 0 }}"
    __has_pod_file_ext: "{{ podman_quadlet_specs | selectattr('file', 'defined') |
      selectattr('file', 'search', '.pod$') | list | length > 0 }}"
    __has_pod_file_src_ext: "{{ podman_quadlet_specs | selectattr('file_src', 'defined') |
      selectattr('file_src', 'search', '.pod$') | list | length > 0 }}"
    __has_pod_template_src_ext: "{{ podman_quadlet_specs | selectattr('template_src', 'defined') |
      selectattr('template_src', 'search', '.pod$') | list | length > 0 }}"
    __has_pod_template_src_ext_j2: "{{ podman_quadlet_specs | selectattr('template_src', 'defined') |
      selectattr('template_src', 'search', '.pod.j2$') | list | length > 0 }}"

- name: Podman package version must be 5.0 or later for Pod quadlets
  meta: end_host
  when:
    - __has_type_pod or __has_pod_file_ext or __has_pod_file_src_ext or
      __has_pod_template_src_ext or __has_pod_template_src_ext_j2
    - podman_version is version("5.0", "<")
    - not podman_fail_if_too_old | d(true)
  vars:
    __has_type_pod: "{{ podman_quadlet_specs | selectattr('type', 'defined') |
      selectattr('type', 'match', '^pod$') | list | length > 0 }}"
    __has_pod_file_ext: "{{ podman_quadlet_specs | selectattr('file', 'defined') |
      selectattr('file', 'search', '.pod$') | list | length > 0 }}"
    __has_pod_file_src_ext: "{{ podman_quadlet_specs | selectattr('file_src', 'defined') |
      selectattr('file_src', 'search', '.pod$') | list | length > 0 }}"
    __has_pod_template_src_ext: "{{ podman_quadlet_specs | selectattr('template_src', 'defined') |
      selectattr('template_src', 'search', '.pod$') | list | length > 0 }}"
    __has_pod_template_src_ext_j2: "{{ podman_quadlet_specs | selectattr('template_src', 'defined') |
      selectattr('template_src', 'search', '.pod.j2$') | list | length > 0 }}"

- name: Check user and group information
  include_tasks: handle_user_group.yml
  vars:
    __podman_user: "{{ podman_run_as_user }}"
    __podman_spec_item: {}

- name: Set config file paths
  set_fact:
    __podman_container_conf_file: "{{ __podman_containers_conf_system
      if podman_run_as_user == 'root' else
      __podman_user_home_dir ~ '/' ~ __podman_containers_conf_user }}"
    __podman_registries_conf_file: "{{ __podman_registries_conf_system
      if podman_run_as_user == 'root' else
      __podman_user_home_dir ~ '/' ~ __podman_registries_conf_user }}"
    __podman_storage_conf_file: "{{ __podman_storage_conf_system
      if podman_run_as_user == 'root' else
      __podman_user_home_dir ~ '/' ~ __podman_storage_conf_user }}"
    __podman_policy_json_file: "{{ __podman_policy_json_system
      if podman_run_as_user == 'root' else
      __podman_user_home_dir ~ '/' ~ __podman_policy_json_user }}"
    __podman_parent_path: "{{ __podman_etc_containers_path
      if podman_run_as_user == 'root' else
      __podman_user_home_dir ~ '/' ~ __podman_user_containers_path }}"
    __podman_parent_mode: "{{ __podman_etc_containers_mode
      if podman_run_as_user == 'root' else
      __podman_user_containers_mode }}"
  vars:
    __podman_user_home_dir: "{{
      ansible_facts['getent_passwd'][podman_run_as_user][4] }}"

- name: Handle container.conf.d
  include_tasks: handle_container_conf_d.yml

- name: Handle registries.conf.d
  include_tasks: handle_registries_conf_d.yml

- name: Handle storage.conf
  include_tasks: handle_storage_conf.yml

- name: Handle policy.json
  include_tasks: handle_policy_json.yml

# This task should ensure that __podman_containers has only
# parameters valid for containers.podman.podman_container - other
# parameters should be stripped out into separate vars
- name: Manage firewall for specified ports
  include_role:
    name: fedora.linux_system_roles.firewall
  vars:
    firewall: "{{ podman_firewall }}"
  when: podman_firewall | length > 0

- name: Manage selinux for specified ports
  include_role:
    name: fedora.linux_system_roles.selinux
  vars:
    selinux_ports: "{{ podman_selinux_ports }}"
  when: podman_selinux_ports | length > 0

- name: Keep track of users that need to cancel linger
  set_fact:
    __podman_cancel_user_linger: []

- name: Handle certs.d files - present
  include_tasks: handle_certs_d.yml
  vars:
    __podman_handle_state: present
  loop: "{{ podman_registry_certificates }}"
  loop_control:
    loop_var: __podman_cert_spec_item
  no_log: true

- name: Handle credential files - present
  include_tasks: handle_credential_files.yml
  vars:
    __podman_handle_state: present
  loop: "{{ podman_credential_files }}"
  loop_control:
    loop_var: __podman_credential_item
  no_log: true

- name: Handle secrets
  include_tasks: handle_secret.yml
  loop: "{{ podman_secrets }}"
  loop_control:
    loop_var: __podman_secret_item
  no_log: true

- name: Handle Kubernetes specifications
  include_tasks: handle_kube_spec.yml
  loop: "{{ podman_kube_specs }}"
  loop_control:
    loop_var: __podman_kube_spec_item
  no_log: true

- name: Handle Quadlet specifications
  include_tasks: handle_quadlet_spec.yml
  loop: "{{ podman_quadlet_specs }}"
  loop_control:
    loop_var: __podman_quadlet_spec_item
  no_log: true

- name: Cancel linger
  include_tasks: cancel_linger.yml
  loop: "{{ __podman_cancel_user_linger }}"
  loop_control:
    loop_var: __podman_linger_user

- name: Handle credential files - absent
  include_tasks: handle_credential_files.yml
  vars:
    __podman_handle_state: absent
  loop: "{{ podman_credential_files }}"
  loop_control:
    loop_var: __podman_credential_item
  no_log: true

- name: Handle certs.d files - absent
  include_tasks: handle_certs_d.yml
  vars:
    __podman_handle_state: absent
  loop: "{{ podman_registry_certificates }}"
  loop_control:
    loop_var: __podman_cert_spec_item
  no_log: true
