- name: Install PHP
  apt: pkg={{ packages }}
  vars:
    packages:
    - php-fpm
    - php-ldap
    - php-gd
    - php
    # spell-checking
    - php-enchant

## TODO: run php as a dedicated system user
- name: Configure PHP 7.4 Zend opcache
  lineinfile: dest=/etc/php/7.4/fpm/php.ini
              regexp='^;?{{ item.var }}\\s*='
              line="{{ item.var }} = {{ item.value }}"
              owner=root group=root
              mode=0644
  with_items:
    - { var: opcache.memory_consumption,      value: 128  }
    - { var: opcache.revalidate_freq,         value: 60   }
  notify:
    - Restart php7.4-fpm

- name: Create '_roundcube' user
  user: name=_roundcube system=yes
        group=nogroup
        createhome=no
        home=/nonexistent
        shell=/usr/sbin/nologin
        password=!
        state=present

- name: Delete PHP 7.4 FPM's www pool
  file: path=/etc/php/7.4/fpm/pool.d/www.conf state=absent
  notify:
    - Restart php7.4-fpm

- name: Configure PHP 7.4 FPM's roundcube pool
  copy: src=etc/php/fpm/pool.d/roundcube.conf
        dest=/etc/php/7.4/fpm/pool.d/roundcube.conf
        owner=root group=root
        mode=0644
  notify:
    - Restart php7.4-fpm

- name: Start php7.4-fpm
  service: name=php7.4-fpm state=started

# Make it sticky: `dpkg-statoverride --add _roundcube nogroup 0700 /var/lib/roundcube/temp`
- name: Create cache directory /var/lib/roundcube/temp
  file: path=/var/lib/roundcube/temp
        state=directory
        owner=_roundcube group=nogroup
        mode=0700

# Make it sticky: `dpkg-statoverride --add _roundcube adm 0750 /var/log/roundcube`
- name: Create cache directory /var/log/roundcube
  file: path=/var/log/roundcube
        state=directory
        owner=_roundcube group=adm
        mode=0750

- name: Install GNU Aspell and some dictionaries
  apt: pkg={{ packages }}
  vars:
    packages:
    - aspell
    - aspell-da
    - aspell-de
    - aspell-en
    - aspell-es
    - aspell-fr
    - aspell-no
    - aspell-sv

- name: Install Roundcube
  apt: pkg={{ packages }}
  vars:
    packages:
    - roundcube-core
    - roundcube-mysql
    - roundcube-plugins
    - roundcube-plugins-extra

- name: Install plugin dependencies
  apt: pkg={{ packages }}
  vars:
    packages:
    - php-net-sieve

- name: Copy fripost's logo
  copy: src=usr/share/roundcube/program/resources/{{ item }}
        dest=/usr/share/roundcube/program/resources/{{ item }}
        owner=root group=root
        mode=0644
  with_items:
    - fripost_logo_black.png
    - fripost_logo_white.png

- name: Configure Roundcube
  lineinfile: dest=/etc/roundcube/config.inc.php
              regexp='^\\s*\\$config\\[\'{{ item.var }}\'\\]\\s*='
              line='$config[\'{{ item.var }}\'] = {{ item.value }};'
              owner=_roundcube group=nogroup
              mode=0600
  with_items:
    # Logging/Debugging
    - { var: smtp_log,               value: "false" }
    # IMAP
    #   WARNING: After hostname change update of mail_host column in users
    #   table is required to match old user data records with the new host.
    - { var: default_host,           value: "'{{ imapsvr_addr | ansible.utils.ipaddr }}'" }
    - { var: default_port,           value: "143"                                         }
    - { var: imap_auth_type,         value: "'PLAIN'"                                     }
    - { var: imap_cache,             value: "null"                                        }
    - { var: imap_timeout,           value: "180"                                         }
    - { var: imap_force_ns,          value: "true"                                        }
    - { var: messages_cache,         value: "false"                                       }
    # SMTP
    - { var: smtp_server,            value: "'{{ postfix_instance.MSA.addr | ansible.utils.ipaddr }}'" }
    - { var: smtp_port,              value:  "{{ postfix_instance.MSA.port          }}"                }
    - { var: smtp_auth_type,         value: "'PLAIN'"                                                  }
    - { var: smtp_user,              value: "'%u'"                                                     }
    - { var: smtp_pass,              value: "'%p'"                                                     }
    # System
    - { var: force_https,            value: "true"              }
    - { var: login_autocomplete,     value: "2"                 }
    - { var: username_domain,        value: "'fripost.org'"     }
    - { var: product_name,           value: "'Fripost Webmail'" }
    - { var: password_charset,       value: "'UTF-8'"           }
    - { var: skin_logo,              value: 'array("classic:*" => "program/resources/fripost_logo_black.png", "larry:*" => "program/resources/fripost_logo_white.png", "elastic:login[favicon]" => "", "elastic:login" => "program/resources/fripost_logo_black.png")' }
    # Plugins
    - { var: plugins,                value: "array('archive','additional_message_headers','attachment_reminder','authres_status','emoticons','hide_blockquote','html5_notifier','managesieve','password','thunderbird_labels','vcard_attachments')" }
    # Spell Checking
    - { var: enable_spellcheck,      value: "'true'"                                    }
    - { var: spellcheck_engine,      value: "'enchant'"                                 }
    - { var: spellcheck_languages,   value: "array('da','de','en','es','fr','no','sv')" }
    # User Interface
    - { var: skin,                   value: "'elastic'"                      }
    - { var: language,               value: "'sv_SE'"                        }
    - { var: create_default_folders, value: "true"                           }
    - { var: support_url,            value: "'https://fripost.org/kontakt/'" }
    # User Preferences
    - { var: htmleditor,             value: "3"     }
    - { var: skip_deleted,           value: "true"  }
    - { var: check_all_folders,      value: "false" }
    - { var: hide_blockquote_limit,  value: "8"     }
    - { var: attachment_reminder,    value: "true"  }
    # Don't allow overriding these settings
    - { var: dont_override, value: "array('use_fallback_verifier', 'trusted_mtas')"  }

- name: Make the logo a hyperlink to the website
  lineinfile: dest=/usr/share/roundcube/skins/{{ item }}/templates/login.html
              regexp='^(\s*)(<roundcube:object name="logo" src="[^"]*"[^>]* />)'
              line='\1<a href="https://fripost.org">\2</a>'
              backrefs=yes
              owner=root group=root
              mode=0644
  with_items:
    - classic
    - larry
    - elastic

- name: Configure Roundcube plugins
  copy: src=etc/roundcube/plugins/{{ item }}/config.inc.php
        dest=/etc/roundcube/plugins/{{ item }}/config.inc.php
        owner=root group=root
        mode=0644
  with_items:
    - additional_message_headers
    - authres_status
    - password
    - html5_notifier
    - thunderbird_labels

- name: Configure Roundcube plugins (2)
  template: src=etc/roundcube/plugins/{{ item }}/config.inc.php.j2
            dest=/etc/roundcube/plugins/{{ item }}/config.inc.php
            owner=root group=root
            mode=0644
  with_items:
    - managesieve

- name: Start php7.4-fpm
  service: name=php7.4-fpm state=started

- name: Copy /etc/cron.d/roundcube-core
  copy: src=etc/cron.d/roundcube-core
        dest=/etc/cron.d/roundcube-core
        owner=root group=root
        mode=0644

- name: Tweak /etc/logrotate.d/roundcube-core
  lineinfile: dest=/etc/logrotate.d/roundcube-core
              regexp='^(\s*)create\s+[0-9]+\s+\S+\s+adm$'
              backrefs=yes
              line='\1create 0640 _roundcube adm'
              owner=root group=root
              mode=0644

- name: Copy /etc/nginx/sites-available/roundcube
  copy: src=etc/nginx/sites-available/roundcube
        dest=/etc/nginx/sites-available/roundcube
        owner=root group=root
        mode=0644
  register: r1
  notify:
    - Restart Nginx

- name: Create /etc/nginx/sites-enabled/roundcube
  file: src=../sites-available/roundcube
        dest=/etc/nginx/sites-enabled/roundcube
        owner=root group=root
        state=link force=yes
  register: r2
  notify:
    - Restart Nginx

- name: Copy HPKP header snippet
  # never modify the pined pubkeys as we don't want to lock out our users
  template: src=etc/nginx/snippets/mail.fripost.org.hpkp-hdr.j2
            dest=/etc/nginx/snippets/mail.fripost.org.hpkp-hdr
            validate=/bin/false
            owner=root group=root
            mode=0644
  register: r3
  notify:
    - Restart Nginx

- name: Start Nginx
  service: name=nginx state=started
  when: not (r1.changed or r2.changed or r3.changed)

- meta: flush_handlers

- name: Fetch Nginx's X.509 certificate
  # Ensure we don't fetch private data
  become: False
  fetch_cmd: cmd="openssl x509 -noout -pubkey"
             stdin=/etc/nginx/ssl/mail.fripost.org.pem
             dest=certs/public/mail.fripost.org.pub
  tags:
    - genkey