---
# Script to run apt install command on servers
#
# To run the script:
# ansible-playbook -K launch_install_check.yml -i hosts-xxx -e 'target=targethost'
# ansible-playbook -K launch_install_check.yml -i hosts-xxx -e 'target=targethost apache=1'
# ansible-playbook -K launch_install_check.yml -i hosts-xxx -e 'target=targethost php74=1 apache=1'
# ansible-playbook -K launch_install_check.yml -i hosts-xxx -e 'target=targethost php80=1 apache=1'
# ansible-playbook -K launch_install_check.yml -i hosts-xxx -e 'target=targethost php81=1 apache=1'
# ansible-playbook -K launch_install_check.yml -i hosts-xxx -e 'target=targethost php83=1 apache=1'
#


# The user admin must be into the group www-data (group of the SSL certificate so apache can read them)
# TODO Remove sshkey to user ubuntu
- name: Check/Fix OS unix accounts
  hosts: '{{target}}'
  become: yes
  become_method: sudo
  become_user: root
  tasks:
#  - name: Get list of all groups for user admin
#    shell: groups admin | sed 's/^.*: //'
#    register: groups  
  # user admin needs to be in www-data group so cron ran with admin has permission on files generated by web user www-data.
  - name: Remove user admin from any group except www-data (no need to be in extra groups)
    user: 
      name: "admin"
      #groups: ''
      groups: 'www-data'
      append: false   
#  - name: Check/create file /home/admin/.ssh/authorized_keys.toallowmaster
#    ansible.builtin.file:
#      path: /home/ubuntu/.ssh/authorized_keys
#      state: present
#  - name: Remove user ubuntu from the sudo group
#    command: "gpasswd -d ubuntu sudo"
#    register: command_result
#    changed_when: "not 'is not a member of' in command_result.stderr"
#    failed_when: "'does not exist in /etc/group' in command_result.stderr"
#  - name: Remove file /home/ubuntu/.ssh/authorized_keys
#    ansible.builtin.file:
#      path: /home/ubuntu/.ssh/authorized_keys
#      state: absent

- name: Update PAM password policy
  hosts: '{{target}}'
  become: yes
  become_method: sudo
  become_user: root
  tasks:
    - name: Ensure minlength is set to 14 in /etc/pam.d/common-password
      lineinfile:
        path: /etc/pam.d/common-password
        regexp: '^password\s+.*\s+pam_unix.so obscure'
        line: 'password        [success=1 default=ignore]      pam_unix.so obscure sha512 minlength=14'
        backrefs: yes
        
- name: Apt install packages
  hosts: '{{target}}'
  become: yes
  become_method: sudo
  become_user: root
  tasks:

  ##### Misc packages
  - name: Launch apt for misc packages
    apt:
      pkg:
      - ntp 
      - git
      - ghostscript 
      - gzip 
      - zip
      - zstd 
      - memcached 
      - ncdu
      - duc
      - iotop
      - acl
      - snapd
    register: command_output

  - debug:
      var: command_output.stdout_lines


  ##### For APACHE
  - name: Launch apt for apache packages
    apt:
      pkg:
      - apache2
      - apache2-bin
      - lynx 
    register: command_output
    when: 
      - apache is defined

  - debug:
      var: command_output.stdout_lines



  ##### For PHP 7.0
  - name: Launch apt for php 7.0 packages
    apt:
      pkg:
      - php7.0 
      - php7.0-cli 
      - libapache2-mod-php7.0 
      #- php7.0-fpm 
      - php7.0-gd 
      - php7.0-imap 
      - php7.0-json 
      - php7.0-ldap 
      - php7.0-mysql 
      - php7.0-curl 
      - php7.0-memcached 
      - php7.0-imagick 
      - php7.0-geoip 
      - php7.0-intl 
      - php7.0-xml 
      - php7.0-zip 
      - php7.0-bz2 
      - php7.0-ssh2 
      - php7.0-mbstring 
      - php7.0-dev
      - php7.0-mcrypt
      - php7.0-soap
      - php7.0-tidy
    register: command_output
    when: 
      - php70 is defined

  - debug:
      var: command_output.stdout_lines
      
      
  ##### For PHP 7.4
  - name: Launch apt for php 7.4 packages
    apt:
      pkg:
      - php7.4 
      - php7.4-cli 
      - libapache2-mod-php7.4 
      #- php7.4-fpm 
      - php7.4-gd 
      - php7.4-imap 
      - php7.4-json 
      - php7.4-ldap 
      - php7.4-mysql 
      - php7.4-curl 
      - php7.4-memcached 
      - php7.4-imagick 
      - php7.4-geoip 
      - php7.4-intl 
      - php7.4-xml 
      - php7.4-zip 
      - php7.4-bz2 
      - php7.4-ssh2 
      - php7.4-mbstring 
      - php7.4-dev
      - php7.4-soap
      - php7.4-tidy
    register: command_output
    when: 
      - php74 is defined

  - debug:
      var: command_output.stdout_lines

  - name: Launch apt for GLPI packages
    apt:
      pkg:
      - php7.4-readline
      - php7.4-xmlrpc
    register: command_output
    when: 
      - php74 is defined
      
  - debug:
      var: command_output.stdout_lines

  ##### For PHP 8.0
  - name: Launch apt for php 8.0 packages
    apt:
      pkg:
      - php8.0 
      - php8.0-cli 
      - libapache2-mod-php8.0 
      #- php8.0-fpm 
      - php8.0-gd 
      - php8.0-imap 
      - php8.0-ldap 
      - php8.0-mysql 
      - php8.0-curl 
      - php8.0-memcached 
      - php8.0-imagick 
      - php8.0-intl 
      - php8.0-xml 
      - php8.0-zip 
      - php8.0-bz2 
      - php8.0-ssh2 
      - php8.0-mbstring 
      - php8.0-dev
      - php8.0-soap
      - php8.0-tidy
    register: command_output
    when: 
      - php80 is defined

  - debug:
      var: command_output.stdout_lines

  - name: Launch apt for GLPI packages
    apt:
      pkg:
      - php8.0-readline
      - php8.0-xmlrpc
    register: command_output
    when: 
      - php80 is defined

  - debug:
      var: command_output.stdout_lines

      
  ##### For PHP 8.1
  - name: Launch apt for php 8.1 packages
    apt:
      pkg:
      - php8.1 
      - php8.1-cli 
      - libapache2-mod-php8.1 
      #- php8.1-fpm 
      - php8.1-gd 
      - php8.1-imap 
      - php8.1-ldap 
      - php8.1-mysql 
      - php8.1-curl 
      - php8.1-memcached 
      - php8.1-imagick 
      - php8.1-intl 
      - php8.1-xml 
      - php8.1-zip 
      - php8.1-bz2 
      - php8.1-ssh2 
      - php8.1-mbstring 
      - php8.1-dev
      - php8.1-soap
      - php8.1-tidy
    register: command_output
    when: 
      - php81 is defined

  - debug:
      var: command_output.stdout_lines

  - name: Launch apt for GLPI packages
    apt:
      pkg:
      - php8.1-readline
      - php8.1-xmlrpc
    register: command_output
    when: 
      - php81 is defined

  - debug:
      var: command_output.stdout_lines
      
      
  ##### For PHP 8.3
  - name: Launch apt for php 8.3 packages
    apt:
      pkg:
      - php8.3 
      - php8.3-cli 
      - libapache2-mod-php8.3 
      #- php8.3-fpm 
      - php8.3-gd 
      - php8.3-imap 
      - php8.3-ldap 
      - php8.3-mysql 
      - php8.3-curl 
      - php8.3-memcached 
      - php8.3-imagick 
      - php8.3-intl 
      - php8.3-xml 
      - php8.3-zip 
      - php8.3-bz2 
      - php8.3-ssh2 
      - php8.3-mbstring 
      - php8.3-dev
      - php8.3-soap
      - php8.3-tidy
    register: command_output
    when: 
      - php83 is defined

  - debug:
      var: command_output.stdout_lines

  - name: Launch apt for GLPI packages
    apt:
      pkg:
      - php8.3-readline
      - php8.3-xmlrpc
    register: command_output
    when: 
      - php83 is defined

  - debug:
      var: command_output.stdout_lines
      
            
  ##### PHP 7.0 apache2/php.ini
  - name: Check or update upload_max_filesize php.ini
    ini_file:
      path: /etc/php/7.0/apache2/php.ini
      section: PHP
      option: upload_max_filesize
      value: 25M
      backup: yes
    when: 
      - php70 is defined

  - name: Check or update post_max_size php.ini
    ini_file:
      path: /etc/php/7.0/apache2/php.ini
      section: PHP
      option: post_max_size
      value: 30M
    when: 
      - php70 is defined

  - name: Check or update max_input_vars php.ini
    ini_file:
      path: /etc/php/7.0/apache2/php.ini
      section: PHP
      option: max_input_vars
      value: '4000'
    when: 
      - php70 is defined

  - name: Check or update memory_limit php.ini
    ini_file:
      path: /etc/php/7.0/apache2/php.ini
      section: PHP
      option: memory_limit
      value: 256M
    when: 
      - php70 is defined

  - name: Check or update disable_functions php.ini
    ini_file:
      path: /etc/php/7.0/apache2/php.ini
      section: PHP
      option: disable_functions
      value: "pcntl_alarm,pcntl_fork,pcntl_waitpid,pcntl_wait,pcntl_wifexited,pcntl_wifstopped,pcntl_wifsignaled,pcntl_wifcontinued,pcntl_wexitstatus,pcntl_wtermsig,pcntl_wstopsig,pcntl_signal,pcntl_signal_get_handler,pcntl_signal_dispatch,pcntl_get_last_error,pcntl_strerror,pcntl_sigprocmask,pcntl_sigwaitinfo,pcntl_sigtimedwait,pcntl_exec,pcntl_getpriority,pcntl_setpriority,pcntl_async_signals,pcntl_unshare,passthru,system,proc_open,dl,apache_note,apache_setenv,show_source,virtual"
    when: 
      - php70 is defined

  - name: Check or update session.gc_maxlifetime php.ini
    ini_file:
      path: /etc/php/7.0/apache2/php.ini
      section: Session
      option: session.gc_maxlifetime
      value: '14400'
    when: 
      - php70 is defined

  - name: Check or update session.use_strict_mode php.ini
    ini_file:
      path: /etc/php/7.0/apache2/php.ini
      section: Session
      option: session.use_strict_mode
      value: '1'
    when: 
      - php70 is defined

  - name: Check or update session.use_only_cookies php.ini
    ini_file:
      path: /etc/php/7.0/apache2/php.ini
      section: Session
      option: session.use_only_cookies
      value: '1'
    when: 
      - php70 is defined

  - name: Check or update session.cookie_httponly php.ini
    ini_file:
      path: /etc/php/7.0/apache2/php.ini
      section: Session
      option: session.cookie_httponly
      value: '1'
    when: 
      - php70 is defined

  - name: Check or update session.cookie_samesite php.ini
    ini_file:
      path: /etc/php/7.0/apache2/php.ini
      section: Session
      option: session.cookie_samesite
      value: Lax
    when: 
      - php70 is defined

  - name: Check or update auto_prepend_file php.ini
    ini_file:
      path: /etc/php/7.0/apache2/php.ini
      section: PHP
      option: auto_prepend_file
      value: /usr/local/bin/phpsendmailprepend.php
    when: 
      - php70 is defined

  - name: Check or update sendmail_path php.ini
    ini_file:
      path: /etc/php/7.0/apache2/php.ini
      section: 'mail function'
      option: sendmail_path
      value: /usr/local/bin/phpsendmail.php
    when: 
      - php70 is defined

  - name: Check or update mail.log php.ini
    ini_file:
      path: /etc/php/7.0/apache2/php.ini
      section: 'mail function'
      option: mail.log
      value: /var/log/phpmail.log
    when: 
      - php70 is defined

  - name: Check or update opcache.memory_consumption php.ini
    ini_file:
      path: /etc/php/7.0/apache2/php.ini
      section: opcache
      option: opcache.memory_consumption
      value: '1024'
    when: 
      - php70 is defined

  - name: Check or update opcache.max_accelerated_files php.ini
    ini_file:
      path: /etc/php/7.0/apache2/php.ini
      section: opcache
      option: opcache.max_accelerated_files
      value: '100000'
    when: 
      - php70 is defined

  ##### cli/php.ini
  - name: Check or update auto_prepend_file cli/php.ini
    ini_file:
      path: /etc/php/7.0/cli/php.ini
      section: PHP
      option: auto_prepend_file
      value: /usr/local/bin/phpsendmailprepend.php
      backup: yes
    when: 
      - php70 is defined

  - name: Check or update sendmail_path cli/php.ini
    ini_file:
      path: /etc/php/7.0/cli/php.ini
      section: PHP
      option: sendmail_path
      value: /usr/local/bin/phpsendmail.php
    when: 
      - php70 is defined

  - name: Check or update mail.log cli/php.ini
    ini_file:
      path: /etc/php/7.0/cli/php.ini
      section: PHP
      option: mail.log
      value: /var/log/phpmail.log
    when: 
      - php70 is defined

  - name: Set PHP version for CLI
    community.general.alternatives:
      name: php
      path: /usr/bin/php7.0
    when: 
      - php70 is defined
      
      
  ##### PHP 7.4 apache2/php.ini
  - name: Check or update upload_max_filesize php.ini
    ini_file:
      path: /etc/php/7.4/apache2/php.ini
      section: PHP
      option: upload_max_filesize
      value: 25M
      backup: yes
    when: 
      - php74 is defined

  - name: Check or update post_max_size php.ini
    ini_file:
      path: /etc/php/7.4/apache2/php.ini
      section: PHP
      option: post_max_size
      value: 30M
    when: 
      - php74 is defined

  - name: Check or update max_input_vars php.ini
    ini_file:
      path: /etc/php/7.4/apache2/php.ini
      section: PHP
      option: max_input_vars
      value: '4000'
    when: 
      - php74 is defined

  - name: Check or update memory_limit php.ini
    ini_file:
      path: /etc/php/7.4/apache2/php.ini
      section: PHP
      option: memory_limit
      value: 256M
    when: 
      - php74 is defined

  - name: Check or update disable_functions php.ini
    ini_file:
      path: /etc/php/7.4/apache2/php.ini
      section: PHP
      option: disable_functions
      value: "pcntl_alarm,pcntl_fork,pcntl_waitpid,pcntl_wait,pcntl_wifexited,pcntl_wifstopped,pcntl_wifsignaled,pcntl_wifcontinued,pcntl_wexitstatus,pcntl_wtermsig,pcntl_wstopsig,pcntl_signal,pcntl_signal_get_handler,pcntl_signal_dispatch,pcntl_get_last_error,pcntl_strerror,pcntl_sigprocmask,pcntl_sigwaitinfo,pcntl_sigtimedwait,pcntl_exec,pcntl_getpriority,pcntl_setpriority,pcntl_async_signals,pcntl_unshare,passthru,system,proc_open,dl,apache_note,apache_setenv,show_source,virtual"
    when: 
      - php74 is defined

  - name: Check or update session.gc_maxlifetime php.ini
    ini_file:
      path: /etc/php/7.4/apache2/php.ini
      section: Session
      option: session.gc_maxlifetime
      value: '14400'
    when: 
      - php74 is defined

  - name: Check or update session.use_strict_mode php.ini
    ini_file:
      path: /etc/php/7.4/apache2/php.ini
      section: Session
      option: session.use_strict_mode
      value: '1'
    when: 
      - php74 is defined

  - name: Check or update session.use_only_cookies php.ini
    ini_file:
      path: /etc/php/7.4/apache2/php.ini
      section: Session
      option: session.use_only_cookies
      value: '1'
    when: 
      - php74 is defined

  - name: Check or update session.cookie_httponly php.ini
    ini_file:
      path: /etc/php/7.4/apache2/php.ini
      section: Session
      option: session.cookie_httponly
      value: '1'
    when: 
      - php74 is defined

  - name: Check or update session.cookie_samesite php.ini
    ini_file:
      path: /etc/php/7.4/apache2/php.ini
      section: Session
      option: session.cookie_samesite
      value: Lax
    when: 
      - php74 is defined

  - name: Check or update auto_prepend_file php.ini
    ini_file:
      path: /etc/php/7.4/apache2/php.ini
      section: PHP
      option: auto_prepend_file
      value: /usr/local/bin/phpsendmailprepend.php
    when: 
      - php74 is defined

  - name: Check or update sendmail_path php.ini
    ini_file:
      path: /etc/php/7.4/apache2/php.ini
      section: 'mail function'
      option: sendmail_path
      value: /usr/local/bin/phpsendmail.php
    when: 
      - php74 is defined

  - name: Check or update mail.log php.ini
    ini_file:
      path: /etc/php/7.4/apache2/php.ini
      section: 'mail function'
      option: mail.log
      value: /var/log/phpmail.log
    when: 
      - php74 is defined

  - name: Check or update opcache.memory_consumption php.ini
    ini_file:
      path: /etc/php/7.4/apache2/php.ini
      section: opcache
      option: opcache.memory_consumption
      value: '1024'
    when: 
      - php74 is defined

  - name: Check or update opcache.max_accelerated_files php.ini
    ini_file:
      path: /etc/php/7.4/apache2/php.ini
      section: opcache
      option: opcache.max_accelerated_files
      value: '100000'
    when: 
      - php74 is defined

  ##### cli/php.ini
  - name: Check or update auto_prepend_file cli/php.ini
    ini_file:
      path: /etc/php/7.4/cli/php.ini
      section: PHP
      option: auto_prepend_file
      value: /usr/local/bin/phpsendmailprepend.php
      backup: yes
    when: 
      - php74 is defined

  - name: Check or update sendmail_path cli/php.ini
    ini_file:
      path: /etc/php/7.4/cli/php.ini
      section: PHP
      option: sendmail_path
      value: /usr/local/bin/phpsendmail.php
    when: 
      - php74 is defined

  - name: Check or update mail.log cli/php.ini
    ini_file:
      path: /etc/php/7.4/cli/php.ini
      section: PHP
      option: mail.log
      value: /var/log/phpmail.log
    when: 
      - php74 is defined

  - name: Set PHP version for CLI
    community.general.alternatives:
      name: php
      path: /usr/bin/php7.4
    when: 
      - php74 is defined

      
  ##### PHP 8.0 apache2/php.ini
  - name: Check or update upload_max_filesize php.ini
    ini_file:
      path: /etc/php/8.0/apache2/php.ini
      section: PHP
      option: upload_max_filesize
      value: 25M
      backup: yes
    when: 
      - php80 is defined

  - name: Check or update post_max_size php.ini
    ini_file:
      path: /etc/php/8.0/apache2/php.ini
      section: PHP
      option: post_max_size
      value: 30M
    when: 
      - php80 is defined

  - name: Check or update max_input_vars php.ini
    ini_file:
      path: /etc/php/8.0/apache2/php.ini
      section: PHP
      option: max_input_vars
      value: '4000'
    when: 
      - php80 is defined

  - name: Check or update memory_limit php.ini
    ini_file:
      path: /etc/php/8.0/apache2/php.ini
      section: PHP
      option: memory_limit
      value: 256M
    when: 
      - php80 is defined

  - name: Check or update disable_functions php.ini
    ini_file:
      path: /etc/php/8.0/apache2/php.ini
      section: PHP
      option: disable_functions
      value: "pcntl_alarm,pcntl_fork,pcntl_waitpid,pcntl_wait,pcntl_wifexited,pcntl_wifstopped,pcntl_wifsignaled,pcntl_wifcontinued,pcntl_wexitstatus,pcntl_wtermsig,pcntl_wstopsig,pcntl_signal,pcntl_signal_get_handler,pcntl_signal_dispatch,pcntl_get_last_error,pcntl_strerror,pcntl_sigprocmask,pcntl_sigwaitinfo,pcntl_sigtimedwait,pcntl_exec,pcntl_getpriority,pcntl_setpriority,pcntl_async_signals,pcntl_unshare,passthru,system,proc_open,dl,apache_note,apache_setenv,show_source,virtual"
    when: 
      - php80 is defined

  - name: Check or update session.gc_maxlifetime php.ini
    ini_file:
      path: /etc/php/8.0/apache2/php.ini
      section: Session
      option: session.gc_maxlifetime
      value: '14400'
    when: 
      - php80 is defined

  - name: Check or update session.use_strict_mode php.ini
    ini_file:
      path: /etc/php/8.0/apache2/php.ini
      section: Session
      option: session.use_strict_mode
      value: '1'
    when: 
      - php80 is defined

  - name: Check or update session.use_only_cookies php.ini
    ini_file:
      path: /etc/php/8.0/apache2/php.ini
      section: Session
      option: session.use_only_cookies
      value: '1'
    when: 
      - php80 is defined

  - name: Check or update session.cookie_httponly php.ini
    ini_file:
      path: /etc/php/8.0/apache2/php.ini
      section: Session
      option: session.cookie_httponly
      value: '1'
    when: 
      - php80 is defined

  - name: Check or update session.cookie_samesite php.ini
    ini_file:
      path: /etc/php/8.0/apache2/php.ini
      section: Session
      option: session.cookie_samesite
      value: Lax
    when: 
      - php80 is defined

  - name: Check or update auto_prepend_file php.ini
    ini_file:
      path: /etc/php/8.0/apache2/php.ini
      section: PHP
      option: auto_prepend_file
      value: /usr/local/bin/phpsendmailprepend.php
    when: 
      - php80 is defined

  - name: Check or update sendmail_path php.ini
    ini_file:
      path: /etc/php/8.0/apache2/php.ini
      section: 'mail function'
      option: sendmail_path
      value: /usr/local/bin/phpsendmail.php
    when: 
      - php80 is defined

  - name: Check or update mail.log php.ini
    ini_file:
      path: /etc/php/8.0/apache2/php.ini
      section: 'mail function'
      option: mail.log
      value: /var/log/phpmail.log
    when: 
      - php80 is defined

  - name: Check or update opcache.memory_consumption php.ini
    ini_file:
      path: /etc/php/8.0/apache2/php.ini
      section: opcache
      option: opcache.memory_consumption
      value: '1024'
    when: 
      - php80 is defined

  - name: Check or update opcache.max_accelerated_files php.ini
    ini_file:
      path: /etc/php/8.0/apache2/php.ini
      section: opcache
      option: opcache.max_accelerated_files
      value: '100000'
    when: 
      - php80 is defined

  ##### cli/php.ini
  - name: Check or update auto_prepend_file cli/php.ini
    ini_file:
      path: /etc/php/8.0/cli/php.ini
      section: PHP
      option: auto_prepend_file
      value: /usr/local/bin/phpsendmailprepend.php
      backup: yes
    when: 
      - php80 is defined

  - name: Check or update sendmail_path cli/php.ini
    ini_file:
      path: /etc/php/8.0/cli/php.ini
      section: PHP
      option: sendmail_path
      value: /usr/local/bin/phpsendmail.php
    when: 
      - php80 is defined

  - name: Check or update mail.log cli/php.ini
    ini_file:
      path: /etc/php/8.0/cli/php.ini
      section: PHP
      option: mail.log
      value: /var/log/phpmail.log
    when: 
      - php80 is defined
      
  - name: Disable old PHP on Apache
    command: a2dismod php7.0 php7.2 php7.3 php7.4
    ignore_errors: true
    when: 
      - php80 is defined
      
  - name: Activates PHP on Apache
    command: a2enmod php8.0
    when: 
      - php80 is defined

  - name: Set PHP version for CLI
    community.general.alternatives:
      name: php
      path: /usr/bin/php8.0
    register: phpversionmodified
    notify: restart-apache
    when: 
      - php80 is defined

  - debug:
      var: phpversionmodified.changed


  ##### PHP 8.1 apache2/php.ini
  - name: Check or update upload_max_filesize php.ini
    ini_file:
      path: /etc/php/8.1/apache2/php.ini
      section: PHP
      option: upload_max_filesize
      value: 25M
      backup: yes
    when: 
      - php81 is defined

  - name: Check or update post_max_size php.ini
    ini_file:
      path: /etc/php/8.1/apache2/php.ini
      section: PHP
      option: post_max_size
      value: 30M
    when: 
      - php81 is defined

  - name: Check or update max_input_vars php.ini
    ini_file:
      path: /etc/php/8.1/apache2/php.ini
      section: PHP
      option: max_input_vars
      value: '4000'
    when: 
      - php81 is defined

  - name: Check or update memory_limit php.ini
    ini_file:
      path: /etc/php/8.1/apache2/php.ini
      section: PHP
      option: memory_limit
      value: 256M
    when: 
      - php81 is defined

  - name: Check or update disable_functions php.ini
    ini_file:
      path: /etc/php/8.1/apache2/php.ini
      section: PHP
      option: disable_functions
      value: "pcntl_alarm,pcntl_fork,pcntl_waitpid,pcntl_wait,pcntl_wifexited,pcntl_wifstopped,pcntl_wifsignaled,pcntl_wifcontinued,pcntl_wexitstatus,pcntl_wtermsig,pcntl_wstopsig,pcntl_signal,pcntl_signal_get_handler,pcntl_signal_dispatch,pcntl_get_last_error,pcntl_strerror,pcntl_sigprocmask,pcntl_sigwaitinfo,pcntl_sigtimedwait,pcntl_exec,pcntl_getpriority,pcntl_setpriority,pcntl_async_signals,pcntl_unshare,passthru,system,proc_open,dl,apache_note,apache_setenv,show_source,virtual"
    when: 
      - php81 is defined

  - name: Check or update session.gc_maxlifetime php.ini
    ini_file:
      path: /etc/php/8.1/apache2/php.ini
      section: Session
      option: session.gc_maxlifetime
      value: '14400'
    when: 
      - php81 is defined

  - name: Check or update session.use_strict_mode php.ini
    ini_file:
      path: /etc/php/8.1/apache2/php.ini
      section: Session
      option: session.use_strict_mode
      value: '1'
    when: 
      - php81 is defined

  - name: Check or update session.use_only_cookies php.ini
    ini_file:
      path: /etc/php/8.0/apache2/php.ini
      section: Session
      option: session.use_only_cookies
      value: '1'
    when: 
      - php80 is defined

  - name: Check or update session.cookie_httponly php.ini
    ini_file:
      path: /etc/php/8.1/apache2/php.ini
      section: Session
      option: session.cookie_httponly
      value: '1'
    when: 
      - php81 is defined

  - name: Check or update session.cookie_samesite php.ini
    ini_file:
      path: /etc/php/8.1/apache2/php.ini
      section: Session
      option: session.cookie_samesite
      value: Lax
    when: 
      - php81 is defined

  - name: Check or update auto_prepend_file php.ini
    ini_file:
      path: /etc/php/8.0/apache2/php.ini
      section: PHP
      option: auto_prepend_file
      value: /usr/local/bin/phpsendmailprepend.php
    when: 
      - php80 is defined

  - name: Check or update sendmail_path php.ini
    ini_file:
      path: /etc/php/8.1/apache2/php.ini
      section: 'mail function'
      option: sendmail_path
      value: /usr/local/bin/phpsendmail.php
    when: 
      - php81 is defined

  - name: Check or update mail.log php.ini
    ini_file:
      path: /etc/php/8.1/apache2/php.ini
      section: 'mail function'
      option: mail.log
      value: /var/log/phpmail.log
    when: 
      - php81 is defined

  - name: Check or update opcache.memory_consumption php.ini
    ini_file:
      path: /etc/php/8.1/apache2/php.ini
      section: opcache
      option: opcache.memory_consumption
      value: '1024'
    when: 
      - php81 is defined

  - name: Check or update opcache.max_accelerated_files php.ini
    ini_file:
      path: /etc/php/8.1/apache2/php.ini
      section: opcache
      option: opcache.max_accelerated_files
      value: '100000'
    when: 
      - php81 is defined

  ##### cli/php.ini
  - name: Check or update auto_prepend_file cli/php.ini
    ini_file:
      path: /etc/php/8.1/cli/php.ini
      section: PHP
      option: auto_prepend_file
      value: /usr/local/bin/phpsendmailprepend.php
      backup: yes
    when: 
      - php81 is defined

  - name: Check or update sendmail_path cli/php.ini
    ini_file:
      path: /etc/php/8.1/cli/php.ini
      section: PHP
      option: sendmail_path
      value: /usr/local/bin/phpsendmail.php
    when: 
      - php81 is defined

  - name: Check or update mail.log cli/php.ini
    ini_file:
      path: /etc/php/8.1/cli/php.ini
      section: PHP
      option: mail.log
      value: /var/log/phpmail.log
    when: 
      - php81 is defined
      
  - name: Disable old PHP on Apache
    command: a2dismod php7.0 php7.2 php7.3 php7.4 php8.0
    ignore_errors: true
    when: 
      - php81 is defined
      
  - name: Activates PHP on Apache
    command: a2enmod php8.1
    when: 
      - php81 is defined

  - name: Set PHP version for CLI
    community.general.alternatives:
      name: php
      path: /usr/bin/php8.1
    register: phpversionmodified
    notify: restart-apache
    when: 
      - php81 is defined

  - debug:
      var: phpversionmodified.changed


  ##### PHP 8.3 apache2/php.ini
  - name: Check or update upload_max_filesize php.ini
    ini_file:
      path: /etc/php/8.3/apache2/php.ini
      section: PHP
      option: upload_max_filesize
      value: 25M
      backup: yes
    when: 
      - php81 is defined

  - name: Check or update post_max_size php.ini
    ini_file:
      path: /etc/php/8.3/apache2/php.ini
      section: PHP
      option: post_max_size
      value: 30M
    when: 
      - php81 is defined

  - name: Check or update max_input_vars php.ini
    ini_file:
      path: /etc/php/8.3/apache2/php.ini
      section: PHP
      option: max_input_vars
      value: '4000'
    when: 
      - php81 is defined

  - name: Check or update memory_limit php.ini
    ini_file:
      path: /etc/php/8.3/apache2/php.ini
      section: PHP
      option: memory_limit
      value: 256M
    when: 
      - php81 is defined

  - name: Check or update disable_functions php.ini
    ini_file:
      path: /etc/php/8.3/apache2/php.ini
      section: PHP
      option: disable_functions
      value: "pcntl_alarm,pcntl_fork,pcntl_waitpid,pcntl_wait,pcntl_wifexited,pcntl_wifstopped,pcntl_wifsignaled,pcntl_wifcontinued,pcntl_wexitstatus,pcntl_wtermsig,pcntl_wstopsig,pcntl_signal,pcntl_signal_get_handler,pcntl_signal_dispatch,pcntl_get_last_error,pcntl_strerror,pcntl_sigprocmask,pcntl_sigwaitinfo,pcntl_sigtimedwait,pcntl_exec,pcntl_getpriority,pcntl_setpriority,pcntl_async_signals,pcntl_unshare,passthru,system,proc_open,dl,apache_note,apache_setenv,show_source,virtual"
    when: 
      - php81 is defined

  - name: Check or update session.gc_maxlifetime php.ini
    ini_file:
      path: /etc/php/8.3/apache2/php.ini
      section: Session
      option: session.gc_maxlifetime
      value: '14400'
    when: 
      - php81 is defined

  - name: Check or update session.use_strict_mode php.ini
    ini_file:
      path: /etc/php/8.3/apache2/php.ini
      section: Session
      option: session.use_strict_mode
      value: '1'
    when: 
      - php81 is defined

  - name: Check or update session.use_only_cookies php.ini
    ini_file:
      path: /etc/php/8.0/apache2/php.ini
      section: Session
      option: session.use_only_cookies
      value: '1'
    when: 
      - php80 is defined

  - name: Check or update session.cookie_httponly php.ini
    ini_file:
      path: /etc/php/8.3/apache2/php.ini
      section: Session
      option: session.cookie_httponly
      value: '1'
    when: 
      - php81 is defined

  - name: Check or update session.cookie_samesite php.ini
    ini_file:
      path: /etc/php/8.3/apache2/php.ini
      section: Session
      option: session.cookie_samesite
      value: Lax
    when: 
      - php81 is defined

  - name: Check or update auto_prepend_file php.ini
    ini_file:
      path: /etc/php/8.0/apache2/php.ini
      section: PHP
      option: auto_prepend_file
      value: /usr/local/bin/phpsendmailprepend.php
    when: 
      - php80 is defined

  - name: Check or update sendmail_path php.ini
    ini_file:
      path: /etc/php/8.3/apache2/php.ini
      section: 'mail function'
      option: sendmail_path
      value: /usr/local/bin/phpsendmail.php
    when: 
      - php81 is defined

  - name: Check or update mail.log php.ini
    ini_file:
      path: /etc/php/8.3/apache2/php.ini
      section: 'mail function'
      option: mail.log
      value: /var/log/phpmail.log
    when: 
      - php81 is defined

  - name: Check or update opcache.memory_consumption php.ini
    ini_file:
      path: /etc/php/8.3/apache2/php.ini
      section: opcache
      option: opcache.memory_consumption
      value: '1024'
    when: 
      - php81 is defined

  - name: Check or update opcache.max_accelerated_files php.ini
    ini_file:
      path: /etc/php/8.3/apache2/php.ini
      section: opcache
      option: opcache.max_accelerated_files
      value: '100000'
    when: 
      - php81 is defined

  ##### cli/php.ini
  - name: Check or update auto_prepend_file cli/php.ini
    ini_file:
      path: /etc/php/8.3/cli/php.ini
      section: PHP
      option: auto_prepend_file
      value: /usr/local/bin/phpsendmailprepend.php
      backup: yes
    when: 
      - php81 is defined

  - name: Check or update sendmail_path cli/php.ini
    ini_file:
      path: /etc/php/8.3/cli/php.ini
      section: PHP
      option: sendmail_path
      value: /usr/local/bin/phpsendmail.php
    when: 
      - php81 is defined

  - name: Check or update mail.log cli/php.ini
    ini_file:
      path: /etc/php/8.3/cli/php.ini
      section: PHP
      option: mail.log
      value: /var/log/phpmail.log
    when: 
      - php81 is defined
      
  - name: Disable old PHP on Apache
    command: a2dismod php7.0 php7.2 php7.3 php7.4 php8.0 php8.1
    ignore_errors: true
    when: 
      - php81 is defined
      
  - name: Activates PHP on Apache
    command: a2enmod php8.3
    when: 
      - php83 is defined

  - name: Set PHP version for CLI
    community.general.alternatives:
      name: php
      path: /usr/bin/php8.3
    register: phpversionmodified
    notify: restart-apache
    when: 
      - php83 is defined

  - debug:
      var: phpversionmodified.changed
      

  # All PHP versions      
  - name: Set php init config files /etc/php/sellyoursaas.ini
    ignore_errors: true
    ansible.builtin.template:
      src: ../../etc/php/sellyoursaas.ini
      dest: /etc/php/sellyoursaas.ini
      owner: root
      group: root
      mode: '0644'  

      
  # TODO Create a symlink for PHP config
  # ln -fs /etc/php/sellyoursaas.ini /etc/php/8.2/apache2/conf.d/sellyoursaas.ini
  
  
  #- name: Reload Apache configs if php or apache config files were changed
  #  service: name=httpd state=reloaded
  #  when: phpversionmodified.changed

  - name: Removed unexpected apt packages
    ignore_errors: yes
    apt:
      pkg:
      - php7.2-fpm 
      - php7.3-fpm 
      - php7.4-fpm 
      - php8.0-fpm
      - php8.1-fpm
      - php8.2-fpm
      - php8.3-fpm
      state: absent 
    register: command_output

  - debug:
      var: command_output.stdout_lines
      

  handlers:
    - name: restart-apache
      service:
        name: apache2
        state: restarted


  ##### Setup files
- name: Check setup files
  hosts: '{{target}}'
  become: yes
  become_method: sudo
  become_user: root
  tasks:
    #- name: Set sshd config files /etc/ssh/sshd_config.d/sellyousaas.conf
    #  ansible.builtin.template:
    #    src: ../../etc/ssh/sshd_config.d/sellyoursaas.conf
    #    dest: /etc/ssh/sshd_config.d/sellyoursaas.conf
    #    owner: root
    #    group: root
    #    mode: '0644'

    - name: Add a section into the sshd_config
      ansible.builtin.blockinfile:
        path: /etc/ssh/sshd_config
        marker: "# {mark} Block for SellYourSaas"
        state: present
        validate: /usr/sbin/sshd -t -f %s
        block: |
          # Warning Match rule works only in sshd_config, not into Included files so we include this block with ansible
          # You can test a Match User rule with ssd -T -C user=aaa | grep param
          #Match User osu*
          #  ChrootDirectory "/home/jail/home/"
          #  ForceCommand /usr/bin/secureBash
          #Match User osu*
          #  ChrootDirectory %h
          Match User osu*
            PasswordAuthentication=yes

    - name: Update PrivateTmp property into /etc/systemd/system/multi-user.target.wants/apache2.service
      lineinfile:
        path: /etc/systemd/system/multi-user.target.wants/apache2.service
        regexp: '^PrivateTmp='
        line: 'PrivateTmp=false'

    #- name: Update Restart property into /etc/systemd/system/multi-user.target.wants/apache2.service to avoid automatic restart of apache
    #  lineinfile:
    #    path: /etc/systemd/system/multi-user.target.wants/apache2.service
    #    regexp: '^Restart='
    #    line: 'Restart=no'
        
    - name: Update policy.xml
      lineinfile:
        path: /etc/ImageMagick-6/policy.xml
        regexp: '^\s*<policy domain="coder" rights="none" pattern="PDF" />'
        line: '<!-- <policy domain="coder" rights="none" pattern="PDF" /> -->'

    - name: Delete file /etc/update-motd.d/00-header
      file:
        path: /etc/update-motd.d/00-header
        state: absent
    - name: Delete file /etc/update-motd.d/20-runabove
      file:
        path: /etc/update-motd.d/20-runabove
        state: absent
    - name: Delete file /etc/update-motd.d/50-landscape-sysinfo
      file:
        path: /etc/update-motd.d/50-landscape-sysinfo
        state: absent
    - name: Find files /etc/update-motd.d/9*-update*-available
      find:
        paths: /etc/update-motd.d/
        patterns: "9*-update*-available"
        file_type: file
      register: fichiers_9
    - name: Delete files /etc/update-motd.d/9*-update*-available
      file:
        path: "{{ item.path }}"
        state: absent
      with_items: "{{ fichiers_9.files }}"
    - name: Delete file 92-unattended-upgrades
      file:
        path: /etc/update-motd.d/92-unattended-upgrades
        state: absent
      
    - name: Search all fail2ban rules into filter.d directory
      ansible.builtin.find:
        paths: /home/admin/wwwroot/dolibarr_sellyoursaas/etc/fail2ban/filter.d
        patterns: '*.conf'
      register: dolibarr_fail2ban_files

    - name: Create links to fail2ban filter files
      ansible.builtin.file:
        src: "{{ item.path }}"
        dest: "/etc/fail2ban/filter.d/{{ item.path | basename }}"  
        state: link
      loop: "{{ dolibarr_fail2ban_files.files }}"      

    - name: Search all fail2ban rules into jail.d directory
      ansible.builtin.find:
        paths: /home/admin/wwwroot/dolibarr_sellyoursaas/etc/fail2ban/jail.d
        patterns: '*.conf'
      register: dolibarr_fail2ban_files2

    - name: Create links to fail2ban jail files only if they do not exist
      ansible.builtin.file:
        src: "{{ item.path }}"
        dest: "/etc/fail2ban/jail.d/{{ item.path | basename }}"  
        state: link
      loop: "{{ dolibarr_fail2ban_files2.files }}"      
      when: not ("/etc/fail2ban/jail.d/{{ item.path | basename }}" | ansible.builtin.stat).islnk)

    - name: Update /etc/afick.conf to remove /var/log/datadog Logs* 
      lineinfile:
        path: /etc/afick.conf
        regexp: '^/var/log/datadog Logs'
        state: absent


    - name: Set an Apache config file custom-server-tokens.conf to hide the version
      ignore_errors: true
      ansible.builtin.template:
        src: ../../etc/apache2/conf-available/custom-server-tokens.conf
        dest: /etc/apache2/conf-available/custom-server-tokens.conf
        owner: root
        group: root
        mode: '0644'

    - name: Activates config file Apache with a2enconf custom-server-tokens
      command: a2enconf custom-server-tokens

    - name: Set datadog config files /etc/datadog-agent/conf.d/disk.d/conf.yaml
      ignore_errors: true
      ansible.builtin.template:
        src: ../../etc/datadog-agent/conf.d/disk.d/conf.yaml
        dest: /etc/datadog-agent/conf.d/disk.d/conf.yaml
        owner: dd-agent
        group: dd-agent
        mode: '0644'

    - name: Set datadog config files /etc/datadog-agent/conf.d/mcache.d/conf.yaml
      ignore_errors: true
      ansible.builtin.template:
        src: ../../etc/datadog-agent/conf.d/mcache.d/conf.yaml
        dest: /etc/datadog-agent/conf.d/mcache.d/conf.yaml
        owner: dd-agent
        group: dd-agent
        mode: '0644'

    - name: Set datadog config files /etc/datadog-agent/conf.d/postfix.d/conf.yaml
      ignore_errors: true
      ansible.builtin.template:
        src: ../../etc/datadog-agent/conf.d/postfix.d/conf.yaml
        dest: /etc/datadog-agent/conf.d/postfix.d/conf.yaml
        owner: dd-agent
        group: dd-agent
        mode: '0644'


##### Check the secureBash shell
- name: Check the secureBash shell
  hosts: '{{target}}'
  become: yes
  become_method: sudo
  become_user: root
  tasks:
    - name: Get checksum for /bin/dash
      stat:
        path: /bin/dash
      register: file1_stat

    - name: Get checksum for /bin/secureBash
      stat:
        path: /bin/secureBash
      register: file2_stat

    - name: Compare file checksums of /bin/dash and /bin/secureBash
      fail:
        msg: "The files secureBash and dash are not the same"
      when: file1_stat.stat.checksum != file2_stat.stat.checksum


##### Set permissions, create some dirs and files by calling perms.sh
- name: Call perms.sh to set permissions, create some dirs and files
  hosts: '{{target}}'
  become: yes
  become_method: sudo
  become_user: root
  tasks:
  - name: Launch perms.sh to set permissions, create some dirs and files
    command: "/home/admin/wwwroot/dolibarr_sellyoursaas/scripts/perms.sh confirm"
    register: command_output
    changed_when: false

  - debug:
      var: command_output.stdout_lines  
