---
# crowdsec-firewall-bouncer in nftables mode stores only the network address of
# a range decision (CIDR scope "Range") in a plain address set. This role keeps
# the ranges in interval sets of its own table, next to the firewall bouncer,
# which keeps handling the single addresses.
- name: Require LAPI settings
  ansible.builtin.assert:
    that:
      - crowdsec.lapi_url | length > 0
      - crowdsec.range_bouncer_api_key | default('') | length > 0
    fail_msg: crowdsec.lapi_url and crowdsec.range_bouncer_api_key must be set

- name: Install python3 and nftables
  ansible.builtin.apt:
    name: [python3, nftables]
    state: present

- name: Configure the range bouncer
  ansible.builtin.template:
    src: crowdsec-range-bouncer.json.j2
    dest: /etc/crowdsec-range-bouncer.json
    mode: "0600"
  no_log: true
  notify: Run the range bouncer

- name: Install the range bouncer
  ansible.builtin.template:
    src: crowdsec-range-bouncer.py.j2
    dest: /usr/local/sbin/crowdsec-range-bouncer
    mode: "0755"
  notify: Run the range bouncer

- name: Install the systemd units
  ansible.builtin.copy:
    src: "{{ item }}"
    dest: "/etc/systemd/system/{{ item }}"
    mode: "0644"
  loop: [crowdsec-range-bouncer.service, crowdsec-range-bouncer.timer]
  register: crowdsec_range_bouncer_units
  notify: Run the range bouncer

- name: Enable the range bouncer timer
  ansible.builtin.systemd:
    name: crowdsec-range-bouncer.timer
    enabled: true
    state: started
    daemon_reload: "{{ crowdsec_range_bouncer_units is changed }}"
  # Check mode does not install the unit.
  ignore_errors: "{{ ansible_check_mode }}"

# The first run has to succeed before the play moves on to the next host.
- name: Apply the changes now
  ansible.builtin.meta: flush_handlers