---
- name: Install Nginx for Debian
  ansible.builtin.import_tasks: nginx-deb.yml
  when: ansible_distribution_file_variety == "Debian"

- name: Install Nginx for EL
  ansible.builtin.import_tasks: nginx-rh.yml
  when: ansible_distribution_file_variety == "RedHat"

- name: Generate Nginx Config
  ansible.builtin.import_tasks: nginx-config.yml

- name: Configure VHosts
  ansible.builtin.import_tasks: nginx-virtualhosts.yml
  #  when: nginx_virthosts is defined
  when: nginx_virthosts | length > 0

- name: Configure streams
  ansible.builtin.import_tasks: nginx-stream.yml
  when: nginx_streams | length > 0

- name: Generate robots.txt
  ansible.builtin.import_tasks: robots-txt.yml

- name: Configure logrotate
  ansible.builtin.import_tasks: nginx-logrotate.yml
#
# - name: Confugure Letsencrypt
#  ansible.builtin.import_tasks: nginx-letsencrypt.yml
#  when: letsencrypt_acme_install is defined and letsencrypt_acme_install
# - ansible.builtin.import_tasks: basic-auth.yml
# - ansible.builtin.import_tasks: pam-ldap.yml

- name: Ensure that the webserver is running and enabled at boot time
  ansible.builtin.service:
    name: nginx
    state: started
    enabled: true
  when: nginx_enabled
  # ignore_errors: true
  failed_when: false
  tags: nginx

- name: Ensure that the webserver is stopped and disabled
  ansible.builtin.service:
    name: nginx
    state: stopped
    enabled: true
  when: not nginx_enabled
  # ignore_errors: true
  failed_when: false
  tags: nginx

# - name: Create file with secure permissions
#  ansible.builtin.file:
#    path: /etc/rsyslog.d/10-local7-to-graylog.conf
#    state: touch
#    owner: root
#    group: root
#    mode: '0644'

# - name: Add rsyslog to graylog
##  ansible.builtin.lineinfile:
#    path: /etc/rsyslog.d/10-local7-to-graylog.conf
#    line: "local7.* @@{{ graylog_server }}:{{ graylog_port }};RSYSLOG_SyslogProtocol23Format"
#    state: present
#  notify: Restart rsyslog service

- name: Add rsyslog configuration
  ansible.builtin.template:
    src: rsyslog.conf.j2
    dest: /etc/rsyslog.d/10-local7-to-graylog.conf
    mode: '0644'
    owner: root
    group: root
  notify: Restart rsyslog service

- name: Set net.netfilter.nf_conntrack_max
  ansible.posix.sysctl:
    name: net.netfilter.nf_conntrack_max
    value: 524288
    state: present
    sysctl_file: /etc/sysctl.d/02-udp.conf

- name: Set net.netfilter.nf_conntrack_udp_timeout
  ansible.posix.sysctl:
    name: net.netfilter.nf_conntrack_udp_timeout
    value: 10
    state: present
    sysctl_file: /etc/sysctl.d/02-udp.conf

- name: Set net.netfilter.nf_conntrack_udp_timeout_stream
  ansible.posix.sysctl:
    name: net.netfilter.nf_conntrack_udp_timeout_stream
    value: 30
    state: present
    sysctl_file: /etc/sysctl.d/02-udp.conf