prepare.yml

---
- name: Prepare
  hosts: "*"
  pre_tasks:
    - name: configure additional package repositories for Debian
      when: ansible_os_family == "Debian"
      block:
        - name: install GPG
          ansible.builtin.apt:
            name: "gnupg"
            state: latest
            update_cache: true
          become: true
        - name: add GPG key for SLUB Debian repository
          ansible.builtin.apt_key:
            url: "https://sdvdebianrepo.slub-dresden.de/deb-repository/pub.gpg.key"
            state: present
          become: true
        - name: add repo URL to sources.list
          ansible.builtin.apt_repository:
            repo: "deb https://sdvdebianrepo.slub-dresden.de/deb-repository bullseye main"
            state: present
            update_cache: true
            mode: "0644"
          become: true

    - name: configure additional package repositories for RedHat
      when: ansible_os_family == "RedHat"
      block:
        - name: add custom repositories
          ansible.builtin.yum_repository:
            name: "{{ item.name }}"
            description: "{{ item.description }}"
            baseurl: "{{ item.baseurl }}"
            gpgcheck: "{{ item.gpgcheck | default('true') }}"
            gpgkey: "{{ item.gpgkey | default(omit) }}"
          loop:
            - name: "epel"
              description: EPEL YUM repo
              baseurl: "https://download.fedoraproject.org/pub/epel/{{ ansible_distribution_major_version }}/x86_64/"
              gpgkey: "https://dl.fedoraproject.org/pub/epel/RPM-GPG-KEY-EPEL-{{ ansible_distribution_major_version }}"
            - name: "slub"
              description: SLUB YUM repo
              baseurl: "https://sdvrhelrepo.slub-dresden.de/"
              gpgcheck: "false"
          become: true
        - name: remove legacy repo configuration to avoid double configuration for SLUB repo
          ansible.builtin.file:
            path: "/etc/yum.repos.d/SLUB.repo"
            state: absent
          become: true
    - name: create Tomcat server.xml file
      block:
        - name: create Tomcat directory
          ansible.builtin.file:
            path: "/exlibris/dps/d4_1/system.dir/thirdparty/tomcat/conf/"
            state: directory
            mode: "0755"
          become: true
        - name: copy Tomcat config
          ansible.builtin.copy:
            src: "../files/server.xml"    # noqa no-relative-paths
            dest: "/exlibris/dps/d4_1/system.dir/thirdparty/tomcat/conf/"
            mode: "0644"
          become: true
    - name: create sudo group, because we ignore RHEL's wheel group
      ansible.builtin.group:
        name: "sudo"
        system: true
      become: true
    - name: get DFN certificate chain
      ansible.builtin.get_url:
        url: "https://pki.pca.dfn.de/dfn-ca-global-g2/pub/cacert/chain.txt"
        dest: "/etc/pki/ca-trust/source/anchors/dfn-ca-global-g2.pem"
        mode: "0644"
      become: true
      register: pki
    - name: update CA trust anchors
      ansible.builtin.command: "update-ca-trust"
      become: true
      when: pki.failed is false
      changed_when: false

  roles:
    - { role: "ansible_lza_install_common", become: true }