---
- name: Apache-Webserver auf RHEL und Ubuntu bereitstellen
  hosts: webserver
  become: true

  tasks:

    # ---------- Installation ----------

    - name: Paketcache unter Debian aktualisieren
      ansible.builtin.apt:
        update_cache: true
        cache_valid_time: 3600
      when: ansible_facts['os_family'] == 'Debian'

    - name: Webserver-Paket installieren
      ansible.builtin.package:
        name: "{{ webserver_paket }}"
        state: present

    # ---------- Inhalt und Konfiguration ----------

    - name: Startseite erzeugen
      ansible.builtin.template:
        src: index.html.j2
        dest: "{{ webserver_docroot }}/index.html"
        owner: root
        group: root
        mode: "0644"

    - name: Konfigurationsdatei ausbringen
      ansible.builtin.template:
        src: tutorial.conf.j2
        dest: "{{ webserver_konfig }}"
        owner: root
        group: root
        mode: "0644"
      notify: Webserver neu laden

    - name: Konfiguration unter Ubuntu aktivieren
      ansible.builtin.command: a2enconf tutorial
      args:
        creates: /etc/apache2/conf-enabled/tutorial.conf
      when: ansible_facts['os_family'] == 'Debian'
      notify: Webserver neu laden

    # ---------- SELinux (nur RHEL) ----------

    - name: SELinux-Werkzeuge installieren
      ansible.builtin.dnf:
        name: policycoreutils-python-utils
        state: present
      when: ansible_facts['os_family'] == 'RedHat'

    - name: SELinux-Kontext des DocumentRoot sicherstellen
      community.general.sefcontext:
        target: "{{ webserver_docroot }}(/.*)?"
        setype: httpd_sys_content_t
        state: present
      when:
        - ansible_facts['os_family'] == 'RedHat'
        - ansible_facts['selinux']['status'] == 'enabled'
      notify: SELinux-Kontext anwenden

    # ---------- Firewall ----------

    - name: Firewalld installieren und starten
      when: ansible_facts['os_family'] == 'RedHat'
      block:
        - name: firewalld sicherstellen
          ansible.builtin.dnf:
            name: firewalld
            state: present

        - name: firewalld starten
          ansible.builtin.service:
            name: firewalld
            state: started
            enabled: true

        - name: HTTP in firewalld freigeben
          ansible.posix.firewalld:
            service: http
            permanent: true
            immediate: true
            state: enabled

    - name: HTTP in ufw freigeben
      community.general.ufw:
        rule: allow
        port: "{{ webserver_port }}"
        proto: tcp
      when: ansible_facts['os_family'] == 'Debian'

    # ---------- Dienst ----------

    - name: Webserver starten und aktivieren
      ansible.builtin.service:
        name: "{{ webserver_dienst }}"
        state: started
        enabled: true

    # ---------- Verifikation ----------

    - name: Erreichbarkeit pruefen
      ansible.builtin.uri:
        url: "http://{{ ansible_facts['default_ipv4']['address'] }}/"
        status_code: 200
        return_content: true
      register: pruefung
      delegate_to: localhost
      become: false

    - name: Ergebnis anzeigen
      ansible.builtin.debug:
        msg: "{{ inventory_hostname }} antwortet mit Status {{ pruefung.status }}"

  handlers:

    - name: Webserver neu laden
      ansible.builtin.service:
        name: "{{ webserver_dienst }}"
        state: reloaded

    - name: SELinux-Kontext anwenden
      ansible.builtin.command: "restorecon -Rv {{ webserver_docroot }}"