main.yml

---

- name: Include version-specific variables for Ubuntu.
  include_vars: "{{ ansible_distribution }}-{{ ansible_distribution_version }}.yml"
  when: ansible_distribution == 'Ubuntu'
- name: Include version-specific variables for RedHat
  include_vars: "RedHat-{{ ansible_distribution_version.split('.')[0] }}.yml"
  when: ansible_os_family == "RedHat"
## must be last to override previous vars
- name: Include webserver+distribution-specific variables
  include_vars: "{{ misp_webserver }}-{{ ansible_distribution }}.yml"

- import_tasks: debian.yml
  when: ansible_distribution == 'Debian' or ansible_distribution == 'Ubuntu'

- import_tasks: redhat.yml
  when: ansible_os_family == "RedHat"

- name: Debug | misp_webserver var
  debug: var=misp_webserver
- import_tasks: nginx.yml
  when: misp_webserver is defined and misp_webserver == 'nginx'

- name: Ensure Random source is configured
  lineinfile:
    dest: /etc/default/rng-tools
    regexp: '^HRNGDEVICE=.*'
    line: 'HRNGDEVICE=/dev/urandom'
    mode: '0644'
    backup: yes
  notify:
    - restart rng-tools
  when: ansible_os_family == "Debian"

- name: Ensure /var/run/mysqld exists
  file:
    dest: /var/run/mysqld
    state: directory
    mode: '0755'
    owner: mysql
  when: (ansible_virtualization_type is defined and ansible_virtualization_type == "docker")

- name: Ensure services are enabled and started
  service: "name={{ item }} state=started enabled=yes"
  with_items: "{{ misp_services }}"
  when: not (ansible_virtualization_type is defined and ansible_virtualization_type == "docker")

- block:
    - name: Debian | Docker | Manually initialize mysql
      shell: >
        mysqld --initialize --datadir='/var/lib/mysql' > /tmp/mysql_install_db.out 2>&1
      args:
        creates: /tmp/mysql_install_db.out
      become: yes
      become_user: mysql
  when: >
    (ansible_virtualization_type is defined and ansible_virtualization_type == "docker") and
    ansible_os_family == "Debian"

- block:
    - name: RedHat | Docker | Manually initialize mysql
      shell: >
        /usr/bin/mysql_install_db > /tmp/mysql_install_db.out 2>&1
      args:
        creates: /tmp/mysql_install_db.out
      become: yes
      become_user: mysql
  when: >
    (ansible_virtualization_type is defined and ansible_virtualization_type == "docker")
    and ansible_os_family == "RedHat"

- block:
    - name: Docker | Manually start mysql service
      shell: >
        /usr/bin/mysqld_safe --datadir='/var/lib/mysql' > /tmp/mysqld_safe.out 2>&1 &
      args:
        creates: /tmp/mysqld_safe.out
        chdir: /var/lib/mysql
  when: >
    (ansible_virtualization_type is defined and ansible_virtualization_type == "docker")

# possible git clone issues else
- name: RedHat | Ensure latest nss curl libcurl
  package:
    name: ['nss', 'curl', 'libcurl']
    state: latest  # noqa 403
  when: ansible_os_family == "RedHat"
  register: pkg_result
  until: pkg_result is success

- import_tasks: redis-secure.yml

- name: ensure archives folder exists
  file:
    dest: "{{ install_archives }}"
    state: directory
    mode: '0755'

- name: load local gpg key to check git signed commit
  copy:
    src: "pgp-{{ item }}.asc"
    dest: "{{ install_archives }}"
    mode: '0400'
  with_items: "{{ misp_git_signing_keys_local }}"
- name: import local gpg key to check git signed commit
  command: "gpg --import {{ install_archives }}/pgp-{{ item }}.asc"
  with_items: "{{ misp_git_signing_keys_local }}"
  register: import0
  changed_when: "'imported: [1-9]+' in import0.stdout"

- name: recover gpg key to check git signed commit
  command: "gpg --keyserver {{ misp_pgp_server }} --recv-keys {{ item }}"
  with_items: "{{ misp_git_signing_keys }}"
  register: import
  changed_when: "'imported: [1-9]+' in import.stdout"
  when: not (misp_proxy_host is defined and misp_proxy_host)

- name: recover gpg key to check git signed commit - proxy
  command: >
    gpg --keyserver {{ misp_pgp_server }} --recv-keys {{ item }}
        --keyserver-options
        \"timeout=10 http-proxy={{ misp_proxy_scheme }}://{{ misp_proxy_host }}:{{ misp_proxy_port }}\"
  with_items: "{{ misp_git_signing_keys }}"
  register: import
  changed_when: "'imported: [1-9]+' in import.stdout"
  when: misp_proxy_host is defined and misp_proxy_host

- name: git setup proxy
  git_config:
    name: http.proxy
    value: "{{ misp_proxy_scheme }}://{{ misp_proxy_host }}:{{ misp_proxy_port }}"
  when: misp_proxy_host is defined and misp_proxy_host

- name: Ensure MISP root dir exists
  file:
    dest: "{{ misp_rootdir }}"
    owner: "{{ www_user }}"
    group: "{{ www_user }}"
    state: directory
    mode: '0755'

- name: Ensure ansible user temp directory is writeable
  file:
    path: /var/www/.ansible
    owner: "{{ www_user }}"
    mode: '0700'
    state: directory

- name: Check if MISP folder already present
  stat: path={{ misp_rootdir }}/INSTALL
  register: m
- name: git clone MISP
  git:
    repo: https://github.com/MISP/MISP.git
    dest: "{{ misp_rootdir }}"
    version: "{{ misp_version }}"
    update: no
    force: no
    ## check if commit signed. only partially the case at Jan 2017. require git 2.1.0+ + import key
    # verify_commit: yes
    # track_submodules: yes
  become: yes
  become_user: "{{ www_user }}"
  # when: not m.stat.exists

- name: update git submodules
  command: "{{ item }}"
  args:
    chdir: "{{ misp_rootdir }}"
  with_items:
    - git submodule update --init --recursive
    - git submodule foreach --recursive git config core.filemode false
  become: yes
  become_user: "{{ www_user }}"
  when: not m.stat.exists

## https://github.com/MISP/MISP/blob/e763e7646f7bbae5183ab93df840501d88c47119/INSTALL/UPDATE.txt
- name: updating existing MISP - minor releases
  # command: "git pull origin {{ misp_version }}"
  # args:
  #   chdir: "{{ misp_rootdir }}"
  # command: "git pull origin {{ misp_version }} --verify-signatures chdir={{ misp_rootdir }}"
  # register: gitpull_result
  # changed_when: not ("'Already up-to-date.' in gitpull_result.stdout")
  git:
    repo: https://github.com/MISP/MISP.git
    dest: "{{ misp_rootdir }}"
    version: "{{ misp_version }}"
    update: yes
    force: yes
  when: m.stat.exists and misp_git_update_force
  notify:
    - updating existing MISP submodules - minor releases
  become: yes
  become_user: "{{ www_user }}"

- name: Ensure pip cache permissions are correct
  file:
    dest: /var/www/.cache/pip/http
    state: directory
    mode: '0755'
    owner: "{{ www_user }}"

- name: install python dependencies with pip - python3
  pip:
    name: "{{ item.n }}"
    version: "{{ item.v }}"
    extra_args: '--exists-action=w'
    virtualenv: "{{ misp_virtualenv }}"
    virtualenv_python: "{{ python3_bin }}"
  with_items:
    - { n: redis, v: '3.5.3' }
    - { n: 'pymisp', v: "{{ misp_pymisp_version }}" }
  environment:
    PATH: "{{ misp_virtualenv }}/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
  become: yes
  become_user: "{{ www_user }}"

- name: install python dependencies with pip - python, latest
  pip:
    name: ['git+https://github.com/kbandla/pydeep.git', 'python-magic', 'zmq', 'plyara']
    extra_args: '--exists-action=w'
    virtualenv: "{{ misp_virtualenv }}"
    virtualenv_python: "{{ python3_bin }}"
  environment:
    PATH: "{{ misp_virtualenv }}/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
  register: pkg_result
  until: pkg_result is success
  become: yes
  become_user: "{{ www_user }}"

## must be after git cloning MISP
- import_tasks: apache2.yml
  when: misp_webserver is not defined or misp_webserver == 'apache2'

- name: setting core.filemode for git
  git_config:
    name: core.filemode
    value: 'false'
    scope: local
    repo: "{{ misp_rootdir }}"

- import_tasks: stix-cybox.yml

- import_tasks: composer.yml

### https://github.com/geerlingguy/ansible-role-php-pecl/blob/master/tasks/main.yml
### FIXME! pecl/redis requires PHP (version >= 7.0.0, version <= 7.1.0, excluded versions: 6.0.0)
# - name: Install PECL libaries.
#   shell: "yes \"\" | pecl install {{ item }}"
#   register: pecl_result
#   changed_when: "pecl_result.rc == 0"
#   failed_when: "not (('already installed' in pecl_result.stdout) or ('install ok:' in pecl_result.stdout))"
#   with_items:
#     - redis
#   when: ansible_os_family == "RedHat"

- name: setup MISP Cake config
  copy:
    src: "{{ misp_rootdir }}/INSTALL/setup/config.php"
    dest: "{{ misp_rootdir }}/app/Plugin/CakeResque/Config/config.php"
    mode: '0644'
    remote_src: true
    backup: yes

- name: validate permissions
  file: "dest={{ item.f }} mode={{ item.m }} owner={{ www_user }} group={{ www_user }} state=directory"
  with_items:
    - { f: "{{ misp_rootdir }}", m: '0755' }
    - { f: "{{ misp_rootdir }}/app/files", m: '2775' }
    - { f: "{{ misp_rootdir }}/app/files/scripts/tmp", m: '2775' }
    - { f: "{{ misp_rootdir }}/app/Plugin/CakeResque/tmp", m: '0775' }
    - { f: "{{ misp_rootdir }}/app/Config", m: '0750' }
    - { f: "{{ misp_rootdir }}/.gnupg", m: '0700' }
    - { f: "{{ misp_rootdir }}/app/webroot", m: '0700' }
- name: check owner/group for multiple MISP folders
  file:
    dest: "{{ item }}"
    owner: "{{ www_user }}"
    group: "{{ www_user }}"
    state: directory
    mode: '02755'
  # with_fileglob:
  #   - {{ misp_rootdir }}/app/files/scripts/tmp/*
  #   - {{ misp_rootdir }}/app/files/scripts/tmp/cache/*
  #   - {{ misp_rootdir }}/app/files/scripts/tmp/cached_exports/*
  with_items:
    - "{{ misp_rootdir }}/app/tmp/"
    - "{{ misp_rootdir }}/app/tmp/sessions"
    - "{{ misp_rootdir }}/app/tmp/cache"
    - "{{ misp_rootdir }}/app/tmp/cache/models"
    - "{{ misp_rootdir }}/app/tmp/cache/persistent"
    - "{{ misp_rootdir }}/app/tmp/cache/views"
    - "{{ misp_rootdir }}/app/tmp/tests"
    - "{{ misp_rootdir }}/app/tmp/logs"
    - "{{ misp_rootdir }}/app/tmp/files"
    - "{{ misp_rootdir }}/app/tmp/cached_exports"
    - "{{ misp_rootdir }}/app/tmp/cached_exports/md5"
    - "{{ misp_rootdir }}/app/tmp/cached_exports/suricata"
    - "{{ misp_rootdir }}/app/tmp/cached_exports/text"
    - "{{ misp_rootdir }}/app/tmp/cached_exports/snort"
    - "{{ misp_rootdir }}/app/tmp/cached_exports/sha1"
    - "{{ misp_rootdir }}/app/tmp/cached_exports/csv_sig"
    - "{{ misp_rootdir }}/app/tmp/cached_exports/csv_all"
    - "{{ misp_rootdir }}/app/tmp/cached_exports/xml"
    - "{{ misp_rootdir }}/app/tmp/cached_exports/rpz"
- name: Check if debug.log exists
  stat: path="{{ misp_rootdir }}/app/tmp/debug.log"
  register: debuglog
- name: touch debug.log
  file:
    dest: "{{ misp_rootdir }}/app/tmp/debug.log"
    mode: '0644'
    owner: "{{ www_user }}"
    group: "{{ www_user }}"
    state: touch
  when: not debuglog.stat.exists

- import_tasks: mysql-configure.yml

- name: extra php settings
  template: "src=misp-php.ini.j2 dest={{ php_confdir }}/misp-php.{{ php_confext }} mode=0644"
  notify:
    - restart webserver
    - restart webserver - docker,debian
    - restart webserver - docker,redhat
- name: Enforce Timezone in php.ini
  replace:
    dest: "{{ php_ini }}"
    regexp: '^;date.timezone ='
    replace: 'date.timezone = {{ tz }}'
    mode: '0644'
  notify:
    - restart webserver
    - restart webserver - docker,debian
    - restart webserver - docker,redhat
- name: enabling MISP php settings
  file:
    src: "{{ php_confdir }}/misp-php.ini"
    dest: "{{ php_confenable }}/99-misp.ini"
    mode: '0644'
    state: link
  notify:
    - restart webserver
    - restart webserver - docker,debian
    - restart webserver - docker,redhat
  when: >
    (ansible_distribution == 'Debian' or ansible_distribution == 'Ubuntu') and
    (misp_webserver is not defined or misp_webserver == 'apache2')

- name: Check if bootstrap.php exists
  stat: path={{ misp_rootdir }}/app/Config/bootstrap.php
  register: conffiles
- name: create config files from default
  copy:
    src: "{{ misp_rootdir }}/app/Config/{{ item }}.default.php"
    dest: "{{ misp_rootdir }}/app/Config/{{ item }}.php"
    mode: '0644'
    owner: "{{ www_user }}"
    remote_src: true
  with_items:
    - bootstrap
    - database
    - core
    ## done later
    # - config
  when: not conffiles.stat.exists and (ansible_distribution == 'Debian' or ansible_distribution == 'Ubuntu')
- name: create config files from default
  copy:
    src: "{{ misp_rootdir }}/app/Config/{{ item }}.default.php"
    dest: "{{ misp_rootdir }}/app/Config/{{ item }}.php"
    mode: '0644'
    remote_src: true
  with_items:
    - bootstrap
    - database
    - core
    # - config
  when: not conffiles.stat.exists and not (ansible_distribution == 'Debian' or ansible_distribution == 'Ubuntu')
- name: ensure right permissions for conf files
  file: "dest={{ misp_rootdir }}/app/Config/{{ item }}.php owner={{ www_user }} mode=0600"
  with_items:
    - bootstrap
    - database
    - core
    # - config

- name: update database settings
  replace:
    dest: "{{ misp_rootdir }}/app/Config/database.php"
    regexp: "{{ item.regexp }}"
    replace: "{{ item.replace }}"
    mode: '0644'
  with_items:
    - { regexp: 'db login', replace: "{{ misp_db_user }}" }
    - { regexp: 'db password', replace: "{{ misp_db_pass }}" }
  no_log: "{{ misp_no_log }}"
- name: set CakeResque bootstrap to true
  lineinfile:
    dest: "{{ misp_rootdir }}/app/Config/bootstrap.php"
    line: "CakePlugin::loadAll(array( 'CakeResque' => array('bootstrap' => true) ));"
    mode: '0644'
- name: set Cache::Config - mask acceptable for snuffleupagus
  lineinfile:
    dest: "{{ misp_rootdir }}/app/Config/bootstrap.php"
    regexp: "^Cache::config.'default', array.'engine' => 'File'.*.;"
    line: "Cache::config('default', array( 'engine' => 'File', 'mask' => 0600 ));"
    mode: '0644'
    backup: yes
  when: misp_php_snuffleupagus_enable
- name: set Cache::Config whole cakephp - mask acceptable for snuffleupagus  # noqa no-tabs
  lineinfile:
    dest: "{{ misp_rootdir }}/app/Lib/cakephp/lib/Cake/Cache/Engine/FileEngine.php"
    regexp: "^\t\t\t'mask' => .*"
    line: "\t\t\t'mask' => 0600"
    mode: '0644'
    backup: yes
  when: misp_php_snuffleupagus_enable
- name: add vendor/autoload.php to core
  lineinfile:
    dest: "{{ misp_rootdir }}/app/Config/core.php"
    line: "{{ item }}"
    mode: '0644'
  with_items:
    - "require_once dirname(__DIR__) . '/Vendor/autoload.php';"

- name: Generating salt
  shell: |
    set -o pipefail
    openssl rand -base64 32 | sed 's@[=\\/\\+]@@g;' | tee {{ misp_rootdir }}/.salt
  args:
    creates: "{{ misp_rootdir }}/.salt"
    executable: /bin/bash
  register: salt1
  changed_when: false
  no_log: "{{ misp_no_log }}"
  tags:
    - salt
- name: Check if .salt exists
  stat: path="{{ misp_rootdir }}/.salt"
  register: s
- name: Recover existing salt
  command: "cat {{ misp_rootdir }}/.salt"
  changed_when: false
  register: salt2
  no_log: "{{ misp_no_log }}"
  when: s.stat.exists
- name: Set salt  # noqa 503
  set_fact:
    salt: "{{ salt1.stdout }}"
  no_log: "{{ misp_no_log }}"
  when: salt1.changed
- name: Set salt
  set_fact:
    salt: "{{ salt2.stdout }}"
  no_log: "{{ misp_no_log }}"
  when: s.stat.exists

# FIXME! idempotence. MISP is rewriting this file regularly
- name: updating MISP config with salt
  template:
    src: "{{ misp_config_php_template }}"
    dest: "{{ misp_rootdir }}/app/Config/config.php"
    mode: '0600'
    backup: yes
    owner: "{{ www_user }}"
  tags:
    - salt

- name: Check if webroot gpg.asc exists
  stat: "path={{ misp_rootdir }}/app/webroot/gpg.asc"
  register: gkey
- name: create gpg configuration template
  template: "src=gpg-template.j2 dest=/var/tmp/gpg-template owner={{ www_user }} mode=0600"
  when: not gkey.stat.exists
- name: redhat | start gpg-agent
  command: "gpg-agent --daemon --homedir={{ misp_rootdir }}/.gnupg"
  become: yes
  become_user: "{{ www_user }}"
  when: not gkey.stat.exists and (ansible_os_family == "RedHat") and misp_webserver == 'nginx'
- name: create gnupg key for {{ misp_email }}
  command: "{{ item.s }}"
  args:
    chdir: "{{ misp_rootdir }}/.gnupg"
    creates: "{{ item.c }}"
  with_items:
    - { s: "gpg --homedir {{ misp_rootdir }}/.gnupg --gen-key --batch /var/tmp/gpg-template",
        c: "{{ misp_rootdir }}/.gnupg/misp.pub"
    }
    - { s: "gpg --homedir {{ misp_rootdir }}/.gnupg --batch --import {{ misp_rootdir }}/.gnupg/misp.pub",
        c: "{{ misp_rootdir }}/app/webroot/gpg.asc"
    }
    # - { s: "gpg --homedir {{ misp_rootdir }}/.gnupg --batch --import {{ gnupg_privdir }}/misp.sec",
    #     c: "{{ misp_rootdir }}/app/webroot/gpg.asc"
    # }
  become: yes
  become_user: "{{ www_user }}"
- name: create gnupg key for {{ misp_email }}
  shell: >
    gpg --homedir {{ misp_rootdir }}/.gnupg --export --armor {{ misp_email }} --batch > {{ misp_rootdir }}/app/webroot/gpg.asc
  args:
    chdir: "{{ misp_rootdir }}/.gnupg"
    creates: "{{ misp_rootdir }}/app/webroot/gpg.asc"
  become: yes
  become_user: "{{ www_user }}"
## it seems to be done by gpg
# - command: wipe -q -y /var/tmp/gpg-template
#   when: not gkey.stat.exists
- name: check permissions of gpg files
  file:
    dest: "{{ item.d }}"
    mode: "{{ item.m }}"
  with_items:
    - { d: "{{ misp_rootdir }}/.gnupg/misp.pub", m: '0400' }
    # - { d: "{{ gnupg_privdir }}/misp.sec", m: '0400' }
    - { d: "{{ misp_rootdir }}/.gnupg/pubring.gpg", m: '0600' }
    - { d: "{{ misp_rootdir }}/.gnupg/secring.gpg", m: '0600' }
  when: >
    not (
          (ansible_distribution == 'Ubuntu' and ansible_distribution_major_version|int >= 18) or
          (ansible_os_family == "RedHat" and ansible_distribution_major_version|int >= 8)
        )

- name: validate worker start.sh permissions
  file: dest={{ misp_rootdir }}/app/Console/worker/start.sh mode=0755

- import_tasks: redhat-logrotate.yml
  when: ansible_os_family == "RedHat"

- import_tasks: selinux-context.yml
  when: ansible_os_family == "RedHat" and ansible_selinux.status is defined and ansible_selinux.status != 'disabled'

- block:
    - name: docker redis workaround ???
      replace:
        dest: /etc/systemd/system/redis.service
        regexp: "{{ item.re }}"
        replace: "{{ item.rep }}"
        mode: '0644'
        backup: yes
      with_items:
        - { re: '^PrivateTmp=yes', rep: 'PrivateTmp=no' }
        - { re: '^PrivateDevices=yes', rep: 'PrivateDevices=no' }
        # - { re: '^', rep: '' }
  when: >
    ansible_virtualization_type is defined and ansible_virtualization_type == "docker"
    and ansible_distribution == "Ubuntu" and ansible_distribution_release == 'xenial'
- name: ensure redis is active before launching worker
  service:
    name: "{{ redis_svc }}"
    state: started
    enabled: yes
  when: not (ansible_virtualization_type is defined and ansible_virtualization_type == "docker")

- name: Docker | Manually start redis
  shell: "/usr/bin/redis-server {{ redis_conf }} --daemonize yes > /tmp/redis.out"
  become: yes
  become_user: redis
  become_flags: -H
  args:
    creates: /tmp/redis.out
  when: (ansible_virtualization_type is defined and ansible_virtualization_type == "docker")

- name: check if worker active
  command: "ps axu"
  register: ps
  changed_when: false
# - debug: var=ps.stdout_lines
- name: start MISP worker
  command: "bash {{ misp_rootdir }}/app/Console/worker/start.sh"
  become: yes
  become_user: "{{ www_user }}"
  when: misp_rootdir + '/app/Vendor/kamisama/php-resque-ex' not in ps.stdout

- name: add MISP worker script for boot
  lineinfile:
    dest: /etc/rc.local
    line: "sudo -H -u {{ www_user }} bash {{ misp_rootdir }}/app/Console/worker/start.sh"
    mode: '0755'
    insertbefore: "^exit 0"
    backup: yes
    create: yes

# snuffleupagus sp.readonly_exec.enable() = php file must be non-writeable (issue with auto-update?)
- name: Ensure that webroot files are not executable and not writeable
  command: "find {{ misp_rootdir }}/app/ -type f -iname '{{ item }}' ! -path {{ misp_rootdir }}/app/Config/config.php ! -name include_paths.php ! -path {{ misp_rootdir }}/app/Config/bootstrap.php ! -path {{ misp_rootdir }}/app/Config/database.php ! -path {{ misp_rootdir }}/app/Config/core.php -exec chmod 0444 {} \\;"  # noqa 301
  with_items:
    - '*.php'
    - '*.ctp'
  when: misp_php_snuffleupagus_enable
- name: Ensure config files are writeable by www user
  file:
    dest: "{{ item }}"
    owner: "{{ www_user }}"
    mode: '0644'
  loop:
    - "{{ misp_rootdir }}/app/Config/bootstrap.php"
    - "{{ misp_rootdir }}/app/Config/config.php"
    - "{{ misp_rootdir }}/app/Config/core.php"
    - "{{ misp_rootdir }}/app/Config/database.php"
  when: misp_php_snuffleupagus_enable
- name: Backup cakephp
  command: >
    cp -R {{ misp_rootdir }}/app/Lib/cakephp {{ misp_rootdir }}/app/Lib/cakephp.orig
  args:
    creates: "{{ misp_rootdir }}/app/Lib/cakephp.orig"
  when: misp_testing is defined and misp_testing
- name: Backup MISP
  copy:
    src: "{{ misp_rootdir }}/app/Controller/AppController.php"
    dest: "{{ misp_rootdir }}/app/Controller/AppController.php.orig"
    mode: '0644'
    remote_src: true
  when: misp_testing is defined and misp_testing
- name: patch cakephp with stricter casting to support sp.global_strict
  patch:
    src: "{{ item.s }}"
    basedir: "{{ item.b }}"
  with_items:
    - { s: patch-cakephp-snuffleupagus-strict, b: "{{ misp_rootdir }}/app/Lib" }
    - { s: patch-app-Lib-cakephp-lib-Cake-Model-Datasource-Database, b: "{{ misp_rootdir }}/app/Lib/cakephp/lib/Cake/Model/Datasource/Database" }
    - { s: patch-app-Lib-Cackephp-lib-Cake-Core-Configure_php, b: "{{ misp_rootdir }}/app/Lib/cakephp/lib/Cake/Core" }
    - { s: patch-app-Lib-Cackephp-lib-Cake-Network-CakeRequest_php, b: "{{ misp_rootdir }}/app/Lib/cakephp/lib/Cake/Network" }
    - { s: patch-app-Lib-Cackephp-lib-Cake-Model-Datasource-Database-Mysql_php, b: "{{ misp_rootdir }}/app/Lib/cakephp/lib/Cake/Model/Datasource/Database" }
    - { s: patch-app-Lib-Cackephp-lib-Cake-Model-Datasource-DboSource_php, b: "{{ misp_rootdir }}/app/Lib/cakephp/lib/Cake/Model/Datasource" }
    - { s: patch-app-Lib-Cackephp-lib-cakephp-lib-Cake-Model-Datasource-CakeSession_php, b: "{{ misp_rootdir }}/app/Lib/cakephp/lib/Cake/Model/Datasource" }
  when: misp_php_snuffleupagus_enable
- name: patch kamisama/php-resque-ex with stricter casting to support sp.global_strict
  patch:
    src: patch-php-resque-ex-master-lib-Resque-Redis.php
    basedir: "{{ misp_rootdir }}/app/Vendor/kamisama/php-resque-ex/lib/Resque"
  when: misp_php_snuffleupagus_enable
- name: patch MISP app for snuffleupagus
  patch:
    src: "{{ item.s }}"
    basedir: "{{ item.b }}"
  with_items:
    - { s: patch-app-Controller-Component, b: "{{ misp_rootdir }}/app/Controller/Component" }
    - { s: patch-app-Lib-Tools, b: "{{ misp_rootdir }}/app/Lib/Tools" }
    - { s: patch-app-Model-Server_php, b: "{{ misp_rootdir }}/app/Model" }
    - { s: patch-app-Model-AppModel_php, b: "{{ misp_rootdir }}/app/Model" }
    - { s: patch-app-Controller-AppController_php, b: "{{ misp_rootdir }}/app/Controller" }
  when: misp_php_snuffleupagus_enable

- import_tasks: lief.yml
  when: misp_lief_enable

- import_tasks: misp-modules.yml
- import_tasks: misp-gem.yml

- import_tasks: testing.yml
  when: misp_testing is defined and misp_testing

- import_tasks: misp-add-users.yml

- import_tasks: misp-feeds.yml

## or use tools/misp-backup/misp-backup.sh ?
- name: Ensure scriptsdir directory exists
  file: path={{ scriptsdir }} state=directory mode=0755
- name: add backup script
  template: src=backup-misp.sh.j2 dest={{ scriptsdir }}/backup-misp.sh mode=0755
- name: add restore script
  template: src=restore-misp.sh.j2 dest={{ scriptsdir }}/restore-misp.sh mode=0755
- name: setup cron backup
  cron: name="misp-backup" minute="30" hour="3" weekday="0"
    job="{{ scriptsdir }}/backup-misp.sh > /dev/null 2>&1"
    user=root
    cron_file=ansible_misp-backup