---
- name: Playbook to configure IPA servers
  hosts: ipaserver
  become: true
  collections:
    - freeipa.ansible_freeipa
  pre_tasks:
    - set_fact:
        ipaserver_realm: "{{ ipaserver_realm|upper }}"
    - name: Remove 127.0.1.1 from /etc/hosts
      lineinfile:
        path: /etc/hosts
        state: absent
        regexp: '^127.0.1.1'
    - name: 'Add association between external ip and ipa domain into etc/hosts'
      lineinfile:
        path: '/etc/hosts'
        line: '{{ ipaserver_ip_addresses|first }} {{ ipaserver_domain }}'
        insertbefore: BOF
    - name: Install packages bind-utils git nano epel-release
      become: true
      package:
        name:
          - bind-utils
          - git
          - nano
          - vim
          - epel-release
        state: present
    - name: Retrieve hostname from IP address.
      command: dig +short +onesoa -x "{{ ansible_default_ipv4.address }}"
      register: dig_out
    - name: Provide reverse_hostname fact.
      set_fact:
        reverse_hostname: "{{ dig_out.stdout_lines[0][:-1] }}"
    - name: Print reverse_hostname
      debug:
        var: reverse_hostname
    - name: Set hostname as ipaserver_domain
      ansible.builtin.hostname:
        name: "{{ ipaserver_domain }}"
        use: systemd
    - name: Disable SELinux
      ansible.posix.selinux:
        state: disabled
    - name: Print domain
      debug:
        var: "{{ ipaserver_domain | default(omit) }}"
    - name: Print hostname
      debug:
        var: "{{ ipaserver_hostname | default(ansible_facts['fqdn']) }}"
  roles:
    - role: freeipa.ansible_freeipa.ipaserver
      state: present
  post_tasks:
    - name: Create a directory 
      ansible.builtin.file:
        path: freeipa-certs
        state: directory
        mode: '0755'
    - name: Download Let is Encrypt CA certificates
      get_url:
        url: "{{ item }}"
        dest: freeipa-certs
      loop:
        - https://letsencrypt.org/certs/isrgrootx1.pem
        - https://letsencrypt.org/certs/isrg-root-x2.pem
        - https://letsencrypt.org/certs/lets-encrypt-r3.pem
        - https://letsencrypt.org/certs/lets-encrypt-e1.pem
        - https://letsencrypt.org/certs/lets-encrypt-r4.pem
        - https://letsencrypt.org/certs/lets-encrypt-e2.pem
    - name: Install Let is Encrypt CA certificates into FreeIPA certificate store
      shell: "ipa-cacert-manage install {{ item }}"
      loop:
        - freeipa-certs/isrgrootx1.pem
        - freeipa-certs/isrg-root-x2.pem
        - freeipa-certs/lets-encrypt-r3.pem
        - freeipa-certs/lets-encrypt-e1.pem
        - freeipa-certs/lets-encrypt-r4.pem
        - freeipa-certs/lets-encrypt-e2.pem
      register: ipa_cacert_manage_install
    - name: Debug ipa-cacert-manage install
      debug:
        var: ipa_cacert_manage_install
    - name: Update local IPA certificate databases with certificates from the server
      shell: "ipa-certupdate"
      register: ipa_certupdate
    - name: Debug ipa-certupdate
      debug:
        var: ipa_certupdate
    - name: Install packages certbot
      become: yes
      package:
        name:
          - certbot
        state: present
    - name: Stop service httpd, if started
      ansible.builtin.service:
        name: httpd
        state: stopped
    - name: Create letsencrypt certificate
      shell: certbot certonly --standalone --preferred-challenges http --agree-tos -n -d {{ ipaserver_domain }} --register-unsafely-without-email
      args:
        creates: /etc/letsencrypt/live/{{ ipaserver_domain }}
      register: create_letsencrypt_certificate
    - name: Debug Create letsencrypt certificate
      debug:
        var: create_letsencrypt_certificate
    - name: Start service httpd, if not started
      ansible.builtin.service:
        name: httpd
        state: started
    - name: Add Lets Encrypt SSL certificates to for use in FreeIPA Web UI
      shell: ipa-server-certinstall -w -d /etc/letsencrypt/live/{{ ipaserver_domain }}/privkey.pem /etc/letsencrypt/live/{{ ipaserver_domain }}/cert.pem -p '{{ ipadm_password }}' --pin=''
      register: add_lets_encrypt_ssl_certificates_to_freeipa
    - name: Debug Add Lets Encrypt SSL certificates to for use in FreeIPA Web UI
      debug:
        var: add_lets_encrypt_ssl_certificates_to_freeipa      
    - name: Restart FreeIPA services
      shell: ipactl restart
      register: restart_freeipa_services
    - name: Debug Restart FreeIPA services
      debug:
        var: restart_freeipa_services   

all:
  children:
    ipaserver:
      hosts:
        "freeipa":
          ansible_host: "xxx.xxx.xxx.xxx"
  vars:
    ansible_user:  centos
    ansible_ssh_private_key_file: ~/.ssh/id_rsa
    ipaadmin_password: xxxxxxx
    ipadm_password: xxxxxxx
    ipaserver_domain: freeipa.84.252.137.134.sslip.io
    ipaserver_realm: freeipa.84.252.137.134.sslip.io
    ipaserver_ip_addresses:
      - '{{ ansible_default_ipv4.address|default(ansible_all_ipv4_addresses[0]) }}'

10.129.0.27 freeipa.84.252.137.134.sslip.io

package freeipa-server is not installed
package freeipa-client is not installed
ipa-server-4.6.8-5.el7.centos.16.x86_64
ipa-client-4.6.8-5.el7.centos.16.x86_64
389-ds-base-1.3.11.1-4.el7_9.x86_64
pki-ca-10.5.18-27.el7_9.noarch
krb5-server-1.15.1-55.el7_9.x86_64