---
# tasks file for zabbix_proxy
- name: "Include OS-specific variables"
  ansible.builtin.include_vars: "{{ ansible_os_family }}.yml"
  tags:
    - always

- name: Determine Latest Supported Zabbix Version
  ansible.builtin.set_fact:
    zabbix_proxy_version: "{{ zabbix_valid_proxy_versions[ansible_distribution_major_version][0] | default(6.4) }}"
  when: zabbix_proxy_version is not defined or zabbix_proxy_version is none
  tags:
    - always

- name: Set More Variables
  ansible.builtin.set_fact:
    zabbix_proxy_db_long: "{{ 'postgresql' if zabbix_proxy_database == 'pgsql' else zabbix_proxy_database }}"
    zabbix_proxy_fpinglocation: "{{ zabbix_proxy_fpinglocation if zabbix_proxy_fpinglocation is defined else _zabbix_proxy_fpinglocation}}"
    zabbix_proxy_fping6location: "{{ zabbix_proxy_fping6location if zabbix_proxy_fping6location is defined else _zabbix_proxy_fping6location}}"
  tags:
    - always

- name: Check that version is supported
  when: enable_version_check | default(true) | bool
  ansible.builtin.assert:
    that:
      - zabbix_proxy_version|float in zabbix_valid_proxy_versions[ ansible_facts['distribution_major_version'] ]
    fail_msg: Zabbix version {{ zabbix_proxy_version }} is not supported on {{ ansible_facts['distribution'] }} {{ ansible_facts['distribution_major_version'] }}
  tags:
    - always

- name: "Set default ip address for zabbix_proxy_ip"
  ansible.builtin.set_fact:
    zabbix_proxy_ip: "{{ hostvars[inventory_hostname]['ansible_default_ipv4'].address }}"
  when:
    - zabbix_proxy_ip is not defined
    - "'ansible_default_ipv4' in hostvars[inventory_hostname]"
  tags:
    - install
    - config
    - api

- name: Install Repository
  ansible.builtin.include_role:
    name: community.zabbix.zabbix_repo
  vars:
    zabbix_repo_apt_priority: "{{ zabbix_proxy_apt_priority | default (omit) }}"
    zabbix_repo_version: "{{ zabbix_proxy_version }}"
    zabbix_repo_package: "zabbix-proxy-{{ zabbix_proxy_database }}"
  when: zabbix_manage_repo | default(true)

- name: "Configure SELinux when enabled"
  ansible.builtin.include_tasks: selinux.yml
  when: ansible_facts.selinux.status | default('disabled') == 'enabled'

- name: "Install zabbix-proxy packages"
  ansible.builtin.package:
    name: "{{ _zabbix_proxy_packages }}"
    state: "{{ zabbix_proxy_package_state }}"
    update_cache: true
    disablerepo: "{{ zabbix_proxy_disable_repo | default(_zabbix_proxy_disable_repo | default(omit)) }}"
  environment:
    http_proxy: "{{ zabbix_http_proxy | default(None) | default(omit) }}"
    https_proxy: "{{ zabbix_https_proxy | default(None) | default(omit) }}"
  register: _zabbix_proxy_package_installed
  until: _zabbix_proxy_package_installed is succeeded
  become: true
  tags:
    - install

- name: "Initialize the database"
  ansible.builtin.include_tasks: "initialize-{{ zabbix_proxy_database }}.yml"

- name: "Create directories"
  ansible.builtin.file:
    state: directory
    path: "{{ item.path }}"
    owner: "{{ zabbix_os_user }}"
    group: "{{ zabbix_os_user }}"
    mode: "{{ item.mode | default('0755') }}"
  become: true
  loop:
    - path: "{{ zabbix_proxy_include_dir }}"
      mode: "{{ zabbix_proxy_include_mode }}"
    - path: "{{ zabbix_proxy_loadmodulepath }}"
    - required: "{{ zabbix_proxy_tlspskfile is defined }}"
      path: "{{ zabbix_proxy_tlspskfile | default('/path/to/zabbix_proxy_tlspskfile/zabbix_proxy.psk') | dirname }}"
  loop_control:
    label: "{{ item.path }}"
  when: item.required | default(true)
  tags:
    - install
    - config

- name: "Place TLS PSK File"
  ansible.builtin.copy:
    dest: "{{ zabbix_proxy_tlspskfile }}"
    content: "{{ zabbix_proxy_tlspsk_secret }}"
    owner: "{{ zabbix_os_user }}"
    group: "{{ zabbix_os_user }}"
    mode: 0400
  become: true
  when:
    - zabbix_proxy_tlspskfile is defined
    - zabbix_proxy_tlspsk_secret is defined
  notify:
    - restart zabbix-proxy
  tags:
    - config

- name: "Configure zabbix-proxy"
  ansible.builtin.template:
    src: zabbix_proxy.conf.j2
    dest: "{{ zabbix_proxy_config }}"
    owner: "{{ zabbix_os_user }}"
    group: "{{ zabbix_os_user }}"
    mode: "{{ zabbix_proxy_conf_mode }}"
  notify: restart zabbix-proxy
  become: true
  tags:
    - config

- name: Ensure proxy definition is up-to-date (added/updated/removed) for Zabbix < 7.0
  vars:
    gather_facts: false
    ansible_network_os: community.zabbix.zabbix
    ansible_connection: httpapi
    ansible_httpapi_use_ssl: "{{ zabbix_api_use_ssl }}"
    # --- Basic Auth (Begin) ---
    http_login_user: "{{ zabbix_api_http_user | default(-42) }}"
    http_login_password: "{{ zabbix_api_http_password | default(-42) }}"
    # --- Basic Auth (End) ---
    ansible_user: "{{ zabbix_api_login_user }}"
    ansible_httpapi_pass: "{{ zabbix_api_login_pass }}"
    ansible_httpapi_port: "{{ zabbix_api_server_port }}"
    ansible_httpapi_validate_certs: "{{ zabbix_api_validate_certs }}"
  community.zabbix.zabbix_proxy:
    state: "{{ zabbix_proxy_state }}"
    status: "{{ zabbix_proxy_status }}"
    proxy_name: "{{ zabbix_proxy_hostname }}"
    description: "{{ zabbix_proxy_description | default(omit) }}"
    interface: "{{ zabbix_proxy_interface }}"
    tls_psk: "{{ zabbix_proxy_tlspsk_secret | default(omit) }}"
    tls_psk_identity: "{{ zabbix_proxy_tlspskidentity | default(omit) }}"
    tls_subject: "{{ zabbix_proxy_tls_subject | default(omit) }}"
    tls_accept: "{{ zabbix_proxy_tls_config[zabbix_proxy_tlsaccept | default('no_encryption')] }}"
    tls_connect: "{{ zabbix_proxy_tls_config[zabbix_proxy_tlsconnect | default('no_encryption')] }}"
  when:
    - zabbix_api_create_proxy | bool
    - zabbix_proxy_version is version('7.0', '<')
  delegate_to: "{{ zabbix_api_server_host }}"
  tags:
    - api

- name: Ensure proxy definition is up-to-date (added/updated/removed) for Zabbix >= 7.0
  vars:
    gather_facts: false
    ansible_network_os: community.zabbix.zabbix
    ansible_connection: httpapi
    ansible_httpapi_use_ssl: "{{ zabbix_api_use_ssl }}"
    # --- Basic Auth (Begin) ---
    http_login_user: "{{ zabbix_api_http_user | default(-42) }}"
    http_login_password: "{{ zabbix_api_http_password | default(-42) }}"
    # --- Basic Auth (End) ---
    ansible_user: "{{ zabbix_api_login_user }}"
    ansible_httpapi_pass: "{{ zabbix_api_login_pass }}"
    ansible_httpapi_port: "{{ zabbix_api_server_port }}"
    ansible_httpapi_validate_certs: "{{ zabbix_api_validate_certs }}"
  community.zabbix.zabbix_proxy:
    state: "{{ zabbix_proxy_state }}"
    operating_mode: "{{ zabbix_proxy_status }}"
    proxy_name: "{{ zabbix_proxy_hostname }}"
    description: "{{ zabbix_proxy_description | default(omit) }}"
    address: "{{ zabbix_proxy_interface['ip'] }}"
    port: "{{ zabbix_proxy_interface['port'] }}"
    local_address: "{{ zabbix_proxy_local_address | default(omit) }}"
    local_port: "{{ zabbix_proxy_local_port | default(omit) }}"
    allowed_addresses: "{{ zabbix_proxy_allowed_addresses | default(omit) }}"
    custom_timeouts: "{{ zabbix_proxy_custom_timeouts | default(omit) }}"
    timeout_zabbix_agent: "{{ zabbix_proxy_timeout_zabbix_agent | default(omit) }}"
    timeout_simple_check: "{{ zabbix_proxy_timeout_simple_check | default(omit) }}"
    timeout_snmp_agent: "{{ zabbix_proxy_timeout_snmp_agent | default(omit) }}"
    timeout_external_check: "{{ zabbix_proxy_timeout_external_check | default(omit) }}"
    timeout_db_monitor: "{{ zabbix_proxy_timeout_db_monitor | default(omit) }}"
    timeout_http_agent: "{{ zabbix_proxy_timeout_http_agent | default(omit) }}"
    timeout_ssh_agent: "{{ zabbix_proxy_timeout_ssh_agent | default(omit) }}"
    timeout_telnet_agent: "{{ zabbix_proxy_timeout_telnet_agent | default(omit) }}"
    timeout_script: "{{ zabbix_proxy_timeout_script | default(omit) }}"
    timeout_browser: "{{ zabbix_proxy_timeout_browser | default(omit) }}"
    tls_accept: "{{ zabbix_proxy_tls_config[zabbix_proxy_tlsaccept | default('no_encryption')] }}"
    tls_connect: "{{ zabbix_proxy_tls_config[zabbix_proxy_tlsconnect | default('no_encryption')] }}"
    tls_psk: "{{ zabbix_proxy_tlspsk_secret | default(omit) }}"
    tls_psk_identity: "{{ zabbix_proxy_tlspskidentity | default(omit) }}"
    ca_cert: "{{ zabbix_proxy_ca_cert | default(omit) }}"
    tls_subject: "{{ zabbix_proxy_tls_subject | default(omit) }}"
  when:
    - zabbix_api_create_proxy | bool
    - zabbix_proxy_version is version('7.0', '>=')
  delegate_to: "{{ zabbix_api_server_host }}"
  tags:
    - api

- name: "zabbix-proxy started"
  ansible.builtin.service:
    name: zabbix-proxy
    state: started
    enabled: true
  become: true
  when: zabbix_proxy_manage_service | bool
  tags:
    - service
