- name: Install PHP
  apt: pkg={{ packages }}
  vars:
    packages:
    - php5-fpm
    - php5-ldap
    - php5-gd
    - php5-apcu
    # spell-checking
    - php5-enchant

- name: Configure PHP5 APCu
  copy: src=etc/php5/mods-available/apcu.ini
        dest=/etc/php5/mods-available/apcu.ini
        owner=root group=root
        mode=0644
  notify:
    - Restart php5

- name: Configure PHP5 Zend opcache
  lineinfile: dest=/etc/php5/fpm/php.ini
              regexp='^;?{{ item.var }}\\s*='
              line="{{ item.var }} = {{ item.value }}"
              owner=root group=root
              mode=0644
  with_items:
    - { var: opcache.enable,                  value: 1    }
    - { var: opcache.enable_cli,              value: 1    }
    - { var: opcache.memory_consumption,      value: 128  }
    - { var: opcache.interned_strings_buffer, value: 8    }
    - { var: opcache.max_accelerated_files,   value: 2048 }
    - { var: opcache.revalidate_freq,         value: 60   }
    - { var: opcache.fast_shutdown,           value: 1    }
  notify:
    - Restart php5

- name: Install GNU Aspell and some dictionaries
  apt: pkg={{ packages }}
  vars:
    packages:
    - aspell
    - aspell-da
    - aspell-de
    - aspell-en
    - aspell-es
    - aspell-fr
    - aspell-no
    - aspell-sv

- name: Install Roundcube
  apt: pkg={{ packages }} default_release={{ ansible_lsb.codename }}-backports
  vars:
    packages:
    - roundcube-core
    - roundcube-mysql
    - roundcube-plugins
    - php-net-sieve
    - php-net-ldap3

- name: Copy fripost's logo
  copy: src=usr/share/roundcube/skins/{{ item }}/images/fripost_logo.png
        dest=/usr/share/roundcube/skins/{{ item }}/images/fripost_logo.png
        owner=root group=root
        mode=0644
  with_items:
    - classic
    - larry

- name: Configure Roundcube
  lineinfile: dest=/etc/roundcube/config.inc.php
              regexp='^\\s*\\$config\\[\'{{ item.var }}\'\\]\\s*='
              line='$config[\'{{ item.var }}\'] = {{ item.value }};'
              owner=root group=www-data
              mode=0640
  with_items:
    # Logging/Debugging
    - { var: smtp_log,               value: "false" }
    # IMAP
    #   WARNING: After hostname change update of mail_host column in users
    #   table is required to match old user data records with the new host.
    - { var: default_host,           value: "'{{ imapsvr_addr | ipaddr }}'" }
    - { var: default_port,           value: "143"                           }
    - { var: imap_auth_type,         value: "'PLAIN'"                       }
    - { var: imap_cache,             value: "null"                          }
    - { var: imap_timeout,           value: "180"                           }
    - { var: imap_force_ns,          value: "true"                          }
    - { var: messages_cache,         value: "false"                         }
    # SMTP
    - { var: smtp_server,            value: "'{{ postfix_instance.MSA.addr | ipaddr }}'" }
    - { var: smtp_port,              value:  "{{ postfix_instance.MSA.port          }}"  }
    - { var: smtp_auth_type,         value: "'PLAIN'"                                    }
    - { var: smtp_user,              value: "'%u'"                                       }
    - { var: smtp_pass,              value: "'%p'"                                       }
    # System
    - { var: force_https,            value: "true"                       }
    - { var: login_autocomplete,     value: "2"                          }
    - { var: skin_logo,              value: "'/images/fripost_logo.png'" }
    - { var: username_domain,        value: "'fripost.org'"              }
    - { var: product_name,           value: "'Fripost Webmail'"          }
    # Plugins
    - { var: plugins,                value: "array('archive','additional_message_headers','managesieve','password')" }
    # Spell Checking
    - { var: enable_spellcheck,      value: "'true'"                                    }
    - { var: spellcheck_engine,      value: "'enchant'"                                 }
    - { var: spellcheck_languages,   value: "array('da','de','en','es','fr','no','sv')" }
    # User Interface
    - { var: skin,                   value: "'larry'"                        }
    - { var: language,               value: "'sv_SE'"                        }
    - { var: create_default_folders, value: "true"                           }
    - { var: support_url,            value: "'https://fripost.org/kontakt/'" }
    # User Preferences
    - { var: htmleditor,             value: "3"     }
    - { var: skip_deleted,           value: "true"  }
    - { var: check_all_folders,      value: "false" }

- name: Make the logo a hyperlink to the website
  lineinfile: dest=/usr/share/roundcube/skins/{{ item }}/templates/login.html
              regexp='^(<roundcube:object name="logo" src="/images/roundcube_logo.png"[^>]* />)$'
              line='<a href="https://fripost.org">\1</a>'
              backrefs=yes
              owner=root group=root
              mode=0644
  with_items:
    - classic
    - larry

- name: Configure Roundcube plugins
  copy: src=etc/roundcube/plugins/{{ item }}/config.inc.php
        dest=/etc/roundcube/plugins/{{ item }}/config.inc.php
        owner=root group=root
        mode=0644
  with_items:
    - additional_message_headers
    - jqueryui
    - password

- name: Configure Roundcube plugins (2)
  template: src=etc/roundcube/plugins/{{ item }}/config.inc.php.j2
            dest=/etc/roundcube/plugins/{{ item }}/config.inc.php
            owner=root group=root
            mode=0644
  with_items:
    - managesieve

- name: Start php5-fpm
  service: name=php5-fpm state=started

- name: Copy /etc/nginx/sites-available/roundcube
  copy: src=etc/nginx/sites-available/roundcube
        dest=/etc/nginx/sites-available/roundcube
        owner=root group=root
        mode=0644
  register: r1
  notify:
    - Restart Nginx

- name: Create /etc/nginx/sites-enabled/roundcube
  file: src=../sites-available/roundcube
        dest=/etc/nginx/sites-enabled/roundcube
        owner=root group=root
        state=link force=yes
  register: r2
  notify:
    - Restart Nginx

- name: Copy HPKP header snippet
  # never modify the pined pubkeys as we don't want to lock out our users
  template: src=etc/nginx/snippets/mail.fripost.org.hpkp-hdr.j2
            dest=/etc/nginx/snippets/mail.fripost.org.hpkp-hdr
            validate=/bin/false
            owner=root group=root
            mode=0644
  register: r3
  notify:
    - Restart Nginx

- name: Start Nginx
  service: name=nginx state=started
  when: not (r1.changed or r2.changed or r3.changed)

- meta: flush_handlers

- name: Fetch Nginx's X.509 certificate
  # Ensure we don't fetch private data
  become: False
  fetch_cmd: cmd="openssl x509 -noout -pubkey"
             stdin=/etc/nginx/ssl/mail.fripost.org.pem
             dest=certs/public/mail.fripost.org.pub
  tags:
    - genkey