matrix-docker-ansible-deploy/roles/custom/matrix-authentication-service/tasks/install.yml

# SPDX-FileCopyrightText: 2024 Slavi Pantaleev
#
# SPDX-License-Identifier: AGPL-3.0-or-later

---

- name: Ensure Matrix Authentication Service paths exist
  ansible.builtin.file:
    path: "{{ item.path }}"
    state: directory
    mode: '0750'
    owner: "{{ matrix_user_name }}"
    group: "{{ matrix_group_name }}"
  with_items:
    - {path: "{{ matrix_authentication_service_base_path }}", when: true}
    - {path: "{{ matrix_authentication_service_bin_path }}", when: true}
    - {path: "{{ matrix_authentication_service_config_path }}", when: true}
    - {path: "{{ matrix_authentication_service_data_path }}", when: true}
    - {path: "{{ matrix_authentication_service_data_keys_path }}", when: true}
    - {path: "{{ matrix_authentication_service_container_src_files_path }}", when: "{{ matrix_authentication_service_container_image_self_build }}"}
  when: "item.when | bool"

- when: matrix_authentication_service_key_management_enabled | bool
  block:
    - name: Ensure openssl installed
      ansible.builtin.package:
        name: openssl
        state: present

    - name: Prepare private key
      ansible.builtin.include_tasks: "{{ role_path }}/tasks/util/prepare_key.yml"
      with_items: "{{ matrix_authentication_service_key_management_list }}"
      loop_control:
        loop_var: private_key_definition

    # We intentionally do a single fixup pass here (instead of in `prepare_key.yml`)
    # so that we reconcile both newly generated keys and any pre-existing keys with
    # incorrect ownership/mode in one place.
    #
    # This primarily protects against setups where `become_user` is effectively not
    # honored (for example due to inventory misconfiguration such as `ansible_become=false`),
    # which can lead to host-side key generation creating root-owned files.
    #
    # See: https://github.com/spantaleev/matrix-docker-ansible-deploy/issues/5033
    - name: Ensure Matrix Authentication Service private keys have correct ownership and mode
      ansible.builtin.file:
        path: "{{ matrix_authentication_service_data_keys_path }}/{{ item.key_file }}"
        state: file
        mode: '0600'
        owner: "{{ matrix_user_name }}"
        group: "{{ matrix_group_name }}"
      with_items: "{{ matrix_authentication_service_key_management_list }}"
      register: matrix_authentication_service_private_keys_result

- name: Ensure Matrix Authentication Service configuration installed
  ansible.builtin.copy:
    content: "{{ matrix_authentication_service_configuration | to_nice_yaml(indent=2, width=999999) }}"
    dest: "{{ matrix_authentication_service_config_path }}/config.yaml"
    mode: '0644'
    owner: "{{ matrix_user_name }}"
    group: "{{ matrix_group_name }}"
  register: matrix_authentication_service_config_result

- name: Ensure Matrix Authentication Service support files created
  ansible.builtin.template:
    src: "{{ item.src }}"
    dest: "{{ item.dest }}"
    mode: "{{ item.mode }}"
    owner: "{{ matrix_user_name }}"
    group: "{{ matrix_group_name }}"
  with_items:
    - src: "{{ role_path }}/templates/env.j2"
      dest: "{{ matrix_authentication_service_config_path }}/env"
      mode: '0644'
    - src: "{{ role_path }}/templates/labels.j2"
      dest: "{{ matrix_authentication_service_config_path }}/labels"
      mode: '0644'
    - src: "{{ role_path }}/templates/bin/register-user.j2"
      dest: "{{ matrix_authentication_service_bin_path }}/register-user"
      mode: '0755'
    - src: "{{ role_path }}/templates/bin/mas-cli.j2"
      dest: "{{ matrix_authentication_service_bin_path }}/mas-cli"
      mode: '0755'
  register: matrix_authentication_service_support_files_result

- name: Ensure Matrix Authentication Service container image is pulled
  community.docker.docker_image_pull:
    name: "{{ matrix_authentication_service_container_image }}"
    pull: always
  when: "not matrix_authentication_service_container_image_self_build | bool"
  register: matrix_authentication_service_container_image_pull_result
  retries: "{{ devture_playbook_help_container_retries_count }}"
  delay: "{{ devture_playbook_help_container_retries_delay }}"
  until: matrix_authentication_service_container_image_pull_result is not failed

- when: "matrix_authentication_service_container_image_self_build | bool"
  block:
    # A checkout owned by a different user (a uid change, an earlier clone by another user, etc.) would make the git task below fail on ownership or permissions.
    - name: Ensure Matrix Authentication Service repository ownership is correct on self-build
      ansible.builtin.file:
        path: "{{ matrix_authentication_service_container_src_files_path }}"
        state: directory
        owner: "{{ matrix_user_name }}"
        group: "{{ matrix_group_name }}"
        recurse: true

    - name: Ensure Matrix Authentication Service repository is present on self-build
      ansible.builtin.git:
        repo: "{{ matrix_authentication_service_container_repo }}"
        version: "{{ matrix_authentication_service_container_repo_version }}"
        dest: "{{ matrix_authentication_service_container_src_files_path }}"
        force: "yes"
      become: true
      become_user: "{{ matrix_user_name }}"

    - name: Ensure Matrix Authentication Service container image is built
      ansible.builtin.command:
        cmd: |-
          {{ devture_systemd_docker_base_host_command_docker }} buildx build
          --tag={{ matrix_authentication_service_container_image }}
          --file={{ matrix_authentication_service_container_src_files_path }}/Dockerfile
          {{ matrix_authentication_service_container_src_files_path }}
      changed_when: true

- name: Ensure Matrix Authentication Service container network is created
  when: matrix_authentication_service_container_network != 'host'
  community.general.docker_network:
    enable_ipv6: "{{ devture_systemd_docker_base_ipv6_enabled }}"
    name: "{{ matrix_authentication_service_container_network }}"
    driver: bridge

- name: Ensure matrix-authentication-service.service installed
  ansible.builtin.template:
    src: "{{ role_path }}/templates/systemd/matrix-authentication-service.service.j2"
    dest: "{{ devture_systemd_docker_base_systemd_path }}/matrix-authentication-service.service"
    mode: '0644'
  register: matrix_authentication_service_systemd_service_result

- name: Determine whether Matrix Authentication Service needs a restart
  ansible.builtin.set_fact:
    matrix_authentication_service_restart_necessary: >-
      {{
        matrix_authentication_service_config_result.changed | default(false)
        or matrix_authentication_service_support_files_result.changed | default(false)
        or matrix_authentication_service_systemd_service_result.changed | default(false)
        or matrix_authentication_service_container_image_pull_result.changed | default(false)
        or matrix_authentication_service_private_keys_result.changed | default(false)
      }}