dm.yaml

---
- name: CentOS 9 configuration for Document Management
  hosts: localhost
  remote_user: root

  vars:
    # Set the interpreter here to 3.9 because some
    #  Python modules we use aren't updated to 3.11
    #  on CentOS 9.
    ansible_python_interpreter: /usr/bin/python3.9
    appgroupname: imaging
    overlay: /root/ImgOverlay-main/var/imaging/resources
    rpms: https://github.com/BlacksilverConsulting/OS9/raw/main/RPM

  handlers:
    - name: Restart FTP server
      ansible.builtin.service:
        name: vsftpd
        enabled: true
        state: restarted

  tasks:
    - name: Create application group
      ansible.builtin.group:
        name: "{{ appgroupname }}"
        state: present

    - name: Create application users
      ansible.builtin.user:
        name: "{{ item }}"
        group: "{{ appgroupname }}"
      loop:
        - listener
        - dbmaint
        - mailer
        - backup

    # BEGIN POSTGRESQL SECTION

    - name: Create application-specific PostgreSQL users
      community.postgresql.postgresql_user:
        name: "{{ item }}"
      # We intentionally do not specify a password here
      #  so these accounts cannot be used except by the
      #  local OS account of the same name.
      loop:
        - dbmaint
        - apache
        - listener
        - root
        - backup
        - mailer
      become: true
      become_user: postgres

    - name: Check for PostgreSQL 14
      ansible.builtin.stat:
        path: /usr/lib/systemd/system/postgresql-14.service
      register: pg14

    - name: Add systemd service alias for PostgreSQL 14
    # This is needed for application-specific automation
    #  that expects `service postgresql stop` to work
      ansible.builtin.file:
        src: /usr/lib/systemd/system/postgresql-14.service
        state: link
        path: /usr/lib/systemd/system/postgresql.service
      when: pg14.stat.exists

### TODO Skip this if the source path doesn't exist
### (To work correctly with pg13.yaml)
    - name: Create /var/lib/pgsql/data symlink
    # This is needed for sysupdate.pl to complete
      ansible.builtin.file:
        state: link
        src: /var/lib/pgsql/14/data
        path: /var/lib/pgsql/data
      when: pg14.stat.exists

    - name: Create fake init.d file
    # This is required for sysupdate 2005091601 to work correctly.
      ansible.builtin.file:
        path: /etc/rc.d/init.d/postgresql
        state: touch
        modification_time: preserve
        access_time: preserve
        mode: "0644"

    # END POSTGRESQL SECTION

    - name: Create /etc/mail directory
      ansible.builtin.file:
        path: /etc/mail
        state: directory
        owner: mail
        group: mail
        mode: "0644"

    - name: Add 'listener' to sendmail trusted users
    # This is needed for the application to send email
      ansible.builtin.lineinfile:
        path: /etc/mail/trusted-users
        create: true
        owner: mail
        group: mail
        line: listener
        mode: "0644"

    - name: Provide /etc/init.d for applications that require it
    # This is needed for sysupdate.pl to complete
      ansible.builtin.file:
        state: link
        src: /etc/rc.d/init.d
        path: /etc/init.d

    - name: Install required groups
      ansible.builtin.yum:
        name:
          - "@smb-server"
          - "@web-server"
        state: present

    - name: Install additional packages
      ansible.builtin.yum:
        state: present
        name:
          - expat
          - expat-devel
          - ncftp
          - ncurses-devel
          - openssl-devel
          - zlib-devel
          - sendmail
          - sendmail-cf
          - vsftpd
          - foomatic-db
          - ImageMagick-perl
          - ImageMagick
          - samba
          - samba-client
          - cifs-utils
          - httpd
          - perl-DBI
          - perl-DBD-Pg
          - perl-App-cpanminus
          - perl-IO-CaptureOutput
          - perl-URI-Encode
          - perl-Class-Std
          - perl-IO-Compress
          - perl-Date-Manip
          - perl-XML-Simple
          - perl-Archive-Zip
          - perl-XML-XPath
          - perl-Compress-Raw-Zlib
          - perl-Term-ReadLine
          - perl-LWP-Protocol-https
          - perl-JSON-PP
          - perl-String-ShellQuote
          - perl-CGI
          - perl-Parse-RecDescent
          - perl-Class-Std-Fast
          - foomatic
          - freetds
          - freetds-devel
          - enscript

    # BEGIN FTP SECTION

    - name: Configure FTP server
      community.general.ini_file:
        path: /etc/vsftpd.conf
        section:
        no_extra_spaces: true
        option: "{{ item.split(':')[0] }}"
        value: "{{ item.split(':')[1] }}"
        mode: "0644"
      loop:
        - local_umask:002
        - write_enable:yes
      notify: Restart FTP server

    - name: Create application FTP accounts
      ansible.builtin.user:
        name: "{{ item.split(':')[0] }}"
        group: "{{ appgroupname }}"
        password: "{{ item.split(':')[1] }}"
        update_password: always
      loop:
        - barcode:$6$mysecretsalt$B1Sq0CjQnI4Y5M.ii2x7kI88/ERDXVyH1Z6JLenQaav7u6qDDnMjZexpCId77bC0SxjyUk1KqYf9sGXRttc4g.
        - inqueue:$6$mysecretsalt$h9Qe0SkCC9h4tcMSRMRNqij7QsMP0o6jQn4JvlOdQJLK6fULfK1GgCkpd1CmER13aDwEgpqrA04s0/rr17Krh/
        - invoice:$6$mysecretsalt$Qc.Fz0ZYIfSjCd.TO00BXXCZkGFOPgpCsl3c2nM7KPKi9yPzQT62.VhCpWPot/TQS7C3tDIHHCAxS54o24e0F/
        - pages:$6$mysecretsalt$XV230BH4czvgKn8KcSW0wWUJVxinBqAbAi2XBTiJTTk5FjVv8ItZ4w9EMRmLdNfoGNzWdHugqPYB.gJYvv5iP.
        - peoplenet:$6$mysecretsalt$mJ8RHipTJVhNyEmCexor4HTxNrcimKwOlCo8qpuX5UDe9HryH7qf10rvz1z5tLWulk8HS04/ROdPNxWpDUiK0.
        - qc:$6$mysecretsalt$mJ8RHipTJVhNyEmCexor4HTxNrcimKwOlCo8qpuX5UDe9HryH7qf10rvz1z5tLWulk8HS04/ROdPNxWpDUiK0.
        - scanner:$6$mysecretsalt$72YAmKvuS9HRllA6nWWV4JR.D54TrkIMrv3y3zZzdwHDg2ndAZu9z2veyGJgsl8op/CmzPRJEndLRVkWSzdSO.
        - templates:$6$mysecretsalt$6TRIJ6gQhES4dFSHvGfzF0aDTW21Y6lVs.pHnT.rx9OZr8kVmADRwreqPxfFtVJR5z8HkGmJUN.60blLWXanR/

    # END FTP SECTION

    - name: Configure required services to start automatically
      ansible.builtin.service:
        name: "{{ item }}"
        state: started
        enabled: true
      loop:
        - cups
        - httpd
        - nmb
        - sendmail
        - smb
        - vsftpd

    - name: Add firewall rules
      ansible.posix.firewalld:
        service: "{{ item }}"
        state: enabled
        immediate: true
        permanent: true
      loop:
        - ftp
        - http
        - samba

    - name: Change ImageMagick policy XML 1/4
      community.general.xml:
        path: /etc/ImageMagick-6/policy.xml
        xpath: /policymap/policy[@pattern="TEXT"]
        state: present
        attribute: domain
        value: coder
        pretty_print: true

    - name: Change ImageMagick policy XML 2/4
      community.general.xml:
        path: /etc/ImageMagick-6/policy.xml
        xpath: /policymap/policy[@pattern="TEXT"]
        state: present
        attribute: rights
        value: read
        pretty_print: true

    - name: Change ImageMagick policy XML 3/4
      community.general.xml:
        path: /etc/ImageMagick-6/policy.xml
        xpath: /policymap/policy[@pattern="LABEL"]
        state: present
        attribute: domain
        value: coder
        pretty_print: true

    - name: Change ImageMagick policy XML 4/4
      community.general.xml:
        path: /etc/ImageMagick-6/policy.xml
        xpath: /policymap/policy[@pattern="LABEL"]
        state: present
        attribute: rights
        value: read
        pretty_print: true

    # BEGIN CRB (FORMERLY POWERTOOLS) SECTION

    - name: Enable Code Ready Linux Builder (CRB) (Was PowerTools)
      ansible.builtin.yum_repository:
        name: crb
        file: centos
        description: CentOS Stream $releasever - CRB
        metalink: https://mirrors.centos.org/metalink?repo=centos-crb-$stream&arch=$basearch&protocol=https,http
        gpgkey: file:///etc/pki/rpm-gpg/RPM-GPG-KEY-centosofficial
        gpgcheck: true
        repo_gpgcheck: false
        metadata_expire: 6h
        enabled: true

    - name: Install packages from Code Ready Linux Builder (was PowerTools)
      ansible.builtin.yum:
        name:
          - gperf.x86_64
          - groff
          - groff-base
          - gsm-devel.x86_64
          - jbigkit-devel.x86_64
          - latex2html.noarch
          - lcms2-devel.x86_64
          - libtiff-tools.x86_64
          - lockdev-devel.x86_64
          - perl-IPC-Run3.noarch
          - perl-Unicode-EastAsianWidth.noarch
          - sharutils.x86_64
          - texinfo.x86_64
          - texinfo-tex.x86_64
        state: present

    # END CRB (FORMERLY POWERTOOLS) SECTION

    - name: Install cpan modules
      community.general.cpanm:
        name: "{{ item }}"
        notest: true
      environment:
        SYBASE: /usr
      loop:
        - Any::Daemon
        - DBD::Sybase
        - IO::Pty
        - IO::Tty
        - List::MoreUtils
        - Log::LogLite
        - Log::Report
        - Mail::POP3Client
        - MIME::Lite
        - Net::Azure::StorageClient
        - Net::FTP::Common
        - Net::LDAP
        - Net::SFTP::Foreign
        - Params::Validate
        - Params::Validate::Checks
        - SOAP::WSDL
        - Term::ReadKey
        - Test::Pod
        - URI::sftp
        - XML::Compile::SOAP::Daemon::AnyDaemon
        - XML::Tidy

    # BEGIN OLD ZIP PARADE

    - name: Install ImgOverlay
    # This is the source for lots of other files we need to install
      ansible.builtin.unarchive:
        dest: /root
        creates: "{{ overlay }}"
        src: https://github.com/BlacksilverConsulting/ImgOverlay/archive/refs/heads/main.zip
        remote_src: true

    - name: Install APF 3.02
      ansible.builtin.unarchive:
        dest: /var/www/html
        creates: /var/www/html/apf_3.02_sdk
        src: "{{ overlay }}/packages/apf_3.02_sdk.zip"

    - name: Install APF Skins
      ansible.builtin.unarchive:
        dest: /var/www/html
        creates: /var/www/html/apf_skin
        src: "{{ overlay }}/packages/apf_skin.zip"

    - name: Install YUI
      ansible.builtin.unarchive:
        dest: /var/www/html
        creates: /var/www/html/yui
        src: "{{ overlay }}/packages/yui-2.9.0.tgz"

    # END OLD ZIP PARADE

    # BEGIN APPLICATION SERVICE->SYSTEMD SHIM

    - name: Install imaging-listener service definition
      ansible.builtin.copy:
        src: "{{ overlay }}/services/imaging-listener.service"
        remote_src: true
        owner: root
        group: root
        mode: "0644"
        dest: /usr/lib/systemd/system

    - name: Enable imaging-listener service
      ansible.builtin.service:
        name: imaging-listener
        enabled: true

    - name: Install imaging-cleanup service definition
      ansible.builtin.copy:
        src: "{{ overlay }}/services/imaging-cleanup.service"
        remote_src: true
        owner: root
        group: root
        mode: "0644"
        dest: /usr/lib/systemd/system

    - name: Enable imaging-cleanup service
      ansible.builtin.service:
        name: imaging-cleanup
        enabled: true

    # END APPLICATION SERVICE->SYSTEMD SHIM

    - name: Create enscript site configuration file
      ansible.builtin.file:
        path: /etc/enscriptsite.cfg
        owner: root
        group: root
        state: touch
        mode: "0644"

    - name: Emulate a2ps site configuration file
      ansible.builtin.file:
        src: /etc/enscriptsite.cfg
        dest: /etc/a2ps-site.cfg
        state: link
        owner: root
        group: root
        mode: "0644"

    - name: Install our built packages from the overlay
      # These packages are needed by the application, but
      #  no longer part of the distribution.
      ansible.builtin.yum:
        name:
          - "{{ rpms }}/a2ps-4.14-23.el8.x86_64.rpm"
          - "{{ rpms }}/groff-perl-1.22.3-18.el8.x86_64.rpm"
        state: present
      # Disable packages for now until we are ready for them.
      when: "0 == 1"