- name: AutoPSK | Set Path Variables for Windows
  ansible.builtin.set_fact:
    zabbix_agent_tlspskfile: "{{ zabbix_win_install_dir }}\\tls_psk_auto.secret.txt"
    zabbix_agent_tlspskidentity_file: "{{ zabbix_win_install_dir }}\\tls_psk_auto.identity.txt"
  when:
    - ansible_os_family == "Windows"
  tags:
    - config

- name: AutoPSK | Check for existing TLS PSK file
  block:
    - name: AutoPSK | Check for existing TLS PSK file | Windows
      ansible.windows.win_stat:
        path: "{{ zabbix_agent_tlspskfile }}"
      register: zabbix_agent_tlspskcheck_windows
      when:
        - ansible_os_family == "Windows"

    - name: AutoPSK | Check for existing TLS PSK file | Linux
      ansible.builtin.stat:
        path: "{{ zabbix_agent_tlspskfile }}"
      register: zabbix_agent_tlspskcheck_linux
      become: true
      when:
        - ansible_os_family != "Windows"

    - name: Set zabbix_agent_tlspskcheck
      ansible.builtin.set_fact:
        zabbix_agent_tlspskcheck: "{{ zabbix_agent_tlspskcheck_windows if ansible_os_family == 'Windows' else zabbix_agent_tlspskcheck_linux }}"
  tags:
    - config

- name: AutoPSK | read existing TLS PSK file
  ansible.builtin.slurp:
    src: "{{ zabbix_agent_tlspskfile }}"
  register: zabbix_agent_tlspsk_base64
  become: true
  when:
    - zabbix_agent_tlspskcheck.stat.exists
  no_log: "{{ ansible_verbosity < 3 }}"
  tags:
    - config

- name: AutoPSK | Save Existing PSK Secret
  ansible.builtin.set_fact:
    zabbix_agent_tlspsk_read: "{{ zabbix_agent_tlspsk_base64['content'] | b64decode | trim }}"
  when: zabbix_agent_tlspskcheck.stat.exists
  no_log: "{{ ansible_verbosity < 3 }}"
  tags:
    - config

- name: AutoPSK | Use Existing PSK Secret
  ansible.builtin.set_fact:
    zabbix_agent_tlspsk_secret: "{{ zabbix_agent_tlspsk_read }}"
  when:
    - zabbix_agent_tlspskcheck.stat.exists
    - zabbix_agent_tlspsk_read|length >= 32
  no_log: "{{ ansible_verbosity < 3 }}"
  tags:
    - config

- name: AutoPSK | Generate New PSK Secret
  ansible.builtin.set_fact:
    zabbix_agent_tlspsk_secret: "{{ lookup('password', '/dev/null chars=hexdigits length=64') }}"
  when:
    - zabbix_agent_tlspsk_secret is undefined
    - zabbix_agent_tlspsk_auto | bool
  no_log: "{{ ansible_verbosity < 3 }}"
  tags:
    - config

- name: AutoPSK | Template PSK Secret
  block:
    - name: Create Directory for PSK File | Windows
      ansible.windows.win_file:
        path: "{{ zabbix_agent_tlspskfile | win_dirname }}"
        state: directory
      when:
        - ansible_os_family == "Windows"

    - name: AutoPSK | Template PSK Secret | Windows
      ansible.windows.win_copy:
        dest: "{{ zabbix_agent_tlspskfile }}"
        content: "{{ zabbix_agent_tlspsk_secret }}"
      when:
        - ansible_os_family == "Windows"
      notify:
        - restart win zabbix agent

    - name: Create Directory for PSK File | Linux
      ansible.builtin.file:
        path: "{{ zabbix_agent_tlspskfile | dirname }}"
        mode: 0755
        state: directory
      become: true
      when:
        - ansible_os_family != "Windows"

    - name: AutoPSK | Template PSK Secret | Linux
      ansible.builtin.copy:
        dest: "{{ zabbix_agent_tlspskfile }}"
        content: "{{ zabbix_agent_tlspsk_secret }}"
        owner: zabbix
        group: zabbix
        mode: 0400
      become: true
      when:
        - ansible_os_family != "Windows"
      notify:
        - restart zabbix-agent
        - restart mac zabbix agent
  when:
    - zabbix_agent_tlspskfile is defined
    - zabbix_agent_tlspsk_secret is defined
  tags:
    - config
