---
- name: Install HAProxy
  dnf:
    name: haproxy
    state: present

- name: Ensure firewalld is running and enabled
  systemd:
    name: firewalld
    enabled: true
    state: started

- name: Allow inbound HTTPS (443/tcp)
  ansible.posix.firewalld:
    service: https
    permanent: true
    state: enabled
    immediate: true

- name: Ensure HAProxy certificate directories exist
  file:
    path: "{{ cert_dir }}"
    state: directory
    owner: haproxy
    group: haproxy
    mode: "0750"
  loop:
    - "{{ haproxy_certs_dir }}"
    - "{{ haproxy_certs_dir }}/clients"
  loop_control:
    loop_var: cert_dir

- name: Apply SELinux context for HAProxy certs
  command: semanage fcontext -a -t etc_t "{{ haproxy_certs_dir }}(/.*)?"
  become: true
  register: semanage_fcontext_result
  failed_when: false
  changed_when: semanage_fcontext_result.rc == 0

- name: Restore SELinux context for HAProxy certs
  command: restorecon -Rv "{{ haproxy_certs_dir }}"
  become: true
  changed_when: false

- name: Allow HAProxy to connect to any port (SELinux)
  ansible.posix.seboolean:
    name: haproxy_connect_any
    state: true
    persistent: true

- name: Wait for HAProxy PEM and CA files
  wait_for:
    path: "{{ pem_item }}"
    state: present
    timeout: 120
  loop:
    - "{{ haproxy_pem_path }}"
    - "{{ haproxy_ca_path }}"
  loop_control:
    loop_var: pem_item

- name: Ensure permissions for HAProxy certs
  file:
    path: "{{ cert_item }}"
    owner: haproxy
    group: haproxy
    mode: "0644"
  loop:
    - "{{ haproxy_pem_path }}"
    - "{{ haproxy_ca_path }}"
  loop_control:
    loop_var: cert_item

- name: Deploy HAProxy configuration
  template:
    src: haproxy.cfg.j2
    dest: /etc/haproxy/haproxy.cfg
    owner: root
    group: root
    mode: "0644"
  notify: Reload HAProxy

- name: Ensure HAProxy service starts after vault-agent
  lineinfile:
    path: /usr/lib/systemd/system/haproxy.service
    regexp: "^After="
    line: "After=network-online.target vault-agent.service"
    backup: yes

- name: Reload systemd daemon
  command: systemctl daemon-reload

- name: Enable and start HAProxy
  systemd:
    name: haproxy
    enabled: yes
    state: started

- name: Check SELinux mode
  command: getenforce
  register: selinux_state
  changed_when: false

- name: Warn if SELinux is not enforcing
  debug:
    msg: "⚠️ SELinux is not enforcing — HAProxy cert contexts may not be correctly applied."
  when: selinux_state.stdout != "Enforcing"