main.yml

---

- name: Include version-specific variables for Ubuntu
  ansible.builtin.include_vars: "{{ ansible_distribution }}-{{ ansible_distribution_version }}.yml"
  when: ansible_distribution == 'Ubuntu'
- name: Include version-specific variables for Debian
  ansible.builtin.include_vars: "Debian-{{ ansible_distribution_version.split('.')[0] }}.yml"
  when: ansible_distribution == 'Debian'
- name: Include version-specific variables for RedHat
  ansible.builtin.include_vars: "RedHat-{{ ansible_distribution_version.split('.')[0] }}.yml"
  when: ansible_os_family == "RedHat"
## must be last to override previous vars
- name: Include webserver+distribution-specific variables
  ansible.builtin.include_vars: "{{ misp_webserver }}-{{ ansible_distribution }}.yml"

- name: Import debian
  ansible.builtin.import_tasks: debian.yml
  when: ansible_distribution == 'Debian' or ansible_distribution == 'Ubuntu'

- name: Import redhat
  ansible.builtin.import_tasks: redhat.yml
  when: ansible_os_family == "RedHat"

- name: Debug | misp_webserver var
  ansible.builtin.debug:
    var: misp_webserver
- name: Import nginx
  ansible.builtin.import_tasks: nginx.yml
  when: misp_webserver is defined and misp_webserver == 'nginx'

- name: Ensure Random source is configured
  ansible.builtin.lineinfile:
    dest: /etc/default/rng-tools
    regexp: '^HRNGDEVICE=.*'
    line: 'HRNGDEVICE=/dev/urandom'
    mode: '0644'
    backup: yes
  notify:
    - Restart rng-tools
  when:
    - ansible_os_family == "Debian"
    - (ansible_distribution == 'Ubuntu' and ansible_distribution_major_version|int < 22)

- name: Ensure /var/run/mysqld exists
  ansible.builtin.file:
    dest: /var/run/mysqld
    state: directory
    mode: '0755'
    owner: mysql
  when: (ansible_virtualization_type is defined and ansible_virtualization_type == "docker")

- name: Ensure services are enabled and started
  ansible.builtin.service:
    name: "{{ item }}"
    state: "started"
    enabled: "yes"
  with_items: "{{ misp_services }}"
  when: not (ansible_virtualization_type is defined and ansible_virtualization_type == "docker")

- name: Debian Docker
  when: >
    (ansible_virtualization_type is defined and ansible_virtualization_type == "docker") and
    ansible_os_family == "Debian"
  block:
    - name: Debian | Docker | Manually initialize mysql
      ansible.builtin.shell:
        cmd: >
          set -o pipefail
          mysqld --initialize --datadir='/var/lib/mysql' 2>&1 | tee /tmp/mysql_install_db.out
      args:
        creates: /tmp/mysql_install_db.out
        executable: /bin/bash
      become: yes
      become_user: mysql

- name: RedHat Docker
  when: >
    (ansible_virtualization_type is defined and ansible_virtualization_type == "docker")
    and ansible_os_family == "RedHat"
  block:
    - name: RedHat | Docker | Manually initialize mysql
      ansible.builtin.shell: >
        /usr/bin/mysql_install_db > /tmp/mysql_install_db.out 2>&1
      args:
        creates: /tmp/mysql_install_db.out
      become: yes
      become_user: mysql

- name: Docker
  when: >
    (ansible_virtualization_type is defined and ansible_virtualization_type == "docker")
  block:
    - name: Docker | Manually start mysql service
      ansible.builtin.shell: >
        /usr/bin/mysqld_safe --datadir='/var/lib/mysql' > /tmp/mysqld_safe.out 2>&1 &
      args:
        creates: /tmp/mysqld_safe.out
        chdir: /var/lib/mysql

- name: Import redis-secure
  ansible.builtin.import_tasks: redis-secure.yml

- name: Ensure archives folder exists
  ansible.builtin.file:
    dest: "{{ install_archives }}"
    state: directory
    mode: '0755'

- name: Load local gpg key to check git signed commit
  ansible.builtin.copy:
    src: "pgp-{{ item }}.asc"
    dest: "{{ install_archives }}"
    mode: '0400'
  with_items: "{{ misp_git_signing_keys_local }}"
- name: Import local gpg key to check git signed commit
  ansible.builtin.command: "gpg --import {{ install_archives }}/pgp-{{ item }}.asc"
  with_items: "{{ misp_git_signing_keys_local }}"
  register: import0
  changed_when: "'imported: [1-9]+' in import0.stdout"

- name: Recover gpg key to check git signed commit
  ansible.builtin.command: "gpg --keyserver {{ misp_pgp_server }} --recv-keys {{ item }}"
  with_items: "{{ misp_git_signing_keys }}"
  register: import1
  changed_when: "'imported: [1-9]+' in import1.stdout"
  when: not (misp_proxy_host is defined and misp_proxy_host)

- name: Recover gpg key to check git signed commit - proxy
  ansible.builtin.command: >
    gpg --keyserver {{ misp_pgp_server }} --recv-keys {{ item }}
        --keyserver-options
        \"timeout=10 http-proxy={{ misp_proxy_scheme }}://{{ misp_proxy_host }}:{{ misp_proxy_port }}\"
  with_items: "{{ misp_git_signing_keys }}"
  register: import1
  changed_when: "'imported: [1-9]+' in import1.stdout"
  when: misp_proxy_host is defined and misp_proxy_host

- name: Git setup proxy
  community.general.git_config:
    name: http.proxy
    value: "{{ misp_proxy_scheme }}://{{ misp_proxy_host }}:{{ misp_proxy_port }}"
  when: misp_proxy_host is defined and misp_proxy_host

- name: Ensure MISP root dir exists
  ansible.builtin.file:
    dest: "{{ misp_rootdir }}"
    owner: "{{ www_user }}"
    group: "{{ www_user }}"
    state: directory
    mode: '0755'

- name: Ensure ansible user temp directory is writeable
  ansible.builtin.file:
    path: /var/www/.ansible
    owner: "{{ www_user }}"
    mode: '0700'
    state: directory

- name: Check if MISP folder already present
  ansible.builtin.stat:
    path: "{{ misp_rootdir }}/INSTALL"
  register: m
- name: Git clone MISP
  ansible.builtin.git:
    repo: https://github.com/MISP/MISP.git
    dest: "{{ misp_rootdir }}"
    version: "{{ misp_version }}"
    update: no
    force: no
    ## check if commit signed. only partially the case at Jan 2017. require git 2.1.0+ + import key
    # verify_commit: yes
    # track_submodules: yes
  become: yes
  become_user: "{{ www_user }}"
  # when: not m.stat.exists

- name: Update git submodules
  ansible.builtin.command:  # noqa no-changed-when
    cmd: "{{ item }}"
  args:
    chdir: "{{ misp_rootdir }}"
  with_items:
    - git submodule update --init --recursive
    - git submodule foreach --recursive git config core.filemode false
  become: yes
  become_user: "{{ www_user }}"
  when: not m.stat.exists

## https://github.com/MISP/MISP/blob/e763e7646f7bbae5183ab93df840501d88c47119/INSTALL/UPDATE.txt
- name: Updating existing MISP - minor releases
  # ansible.builtin.command: "git pull origin {{ misp_version }}"
  # args:
  #   chdir: "{{ misp_rootdir }}"
  # ansible.builtin.command: "git pull origin {{ misp_version }} --verify-signatures chdir={{ misp_rootdir }}"
  # register: gitpull_result
  # changed_when: not ("'Already up-to-date.' in gitpull_result.stdout")
  ansible.builtin.git:
    repo: https://github.com/MISP/MISP.git
    dest: "{{ misp_rootdir }}"
    version: "{{ misp_version }}"
    update: yes
    force: yes
  when: m.stat.exists and misp_git_update_force
  notify:
    - updating existing MISP submodules - minor releases
  become: yes
  become_user: "{{ www_user }}"

- name: Ensure pip cache permissions are correct
  ansible.builtin.file:
    dest: /var/www/.cache/pip/http
    state: directory
    mode: '0755'
    owner: "{{ www_user }}"

- name: Install python dependencies with pip - python3
  ansible.builtin.pip:
    name: "{{ item.n }}"
    version: "{{ item.v }}"
    extra_args: '--exists-action=w'
    virtualenv: "{{ misp_virtualenv }}"
    virtualenv_python: "{{ python3_bin }}"
  with_items:
    - { n: redis, v: '3.5.3' }
    - { n: 'pymisp', v: "{{ misp_pymisp_version }}" }
  environment:
    PATH: "{{ misp_virtualenv }}/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
  become: yes
  become_user: "{{ www_user }}"

- name: Install python dependencies with pip - python, latest
  ansible.builtin.pip:
    name: ['git+https://github.com/kbandla/pydeep.git', 'python-magic', 'zmq', 'plyara']
    extra_args: '--exists-action=w'
    virtualenv: "{{ misp_virtualenv }}"
    virtualenv_python: "{{ python3_bin }}"
  environment:
    PATH: "{{ misp_virtualenv }}/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
  register: pkg_result
  until: pkg_result is success
  become: yes
  become_user: "{{ www_user }}"

## must be after git cloning MISP
- name: Import apache2
  ansible.builtin.import_tasks: apache2.yml
  when: misp_webserver is not defined or misp_webserver == 'apache2'

- name: Setting core.filemode for git
  community.general.git_config:
    name: core.filemode
    value: 'false'
    scope: local
    repo: "{{ misp_rootdir }}"
  become: yes
  become_user: "{{ www_user }}"

- name: Import stix-cybox
  ansible.builtin.import_tasks: stix-cybox.yml

- name: Import composer
  ansible.builtin.import_tasks: composer.yml

### https://github.com/geerlingguy/ansible-role-php-pecl/blob/master/tasks/main.yml
### FIXME! pecl/redis requires PHP (version >= 7.0.0, version <= 7.1.0, excluded versions: 6.0.0)
# - name: Install PECL libraries.
#   ansible.builtin.shell: "yes \"\" | pecl install {{ item }}"
#   register: pecl_result
#   changed_when: "pecl_result.rc == 0"
#   failed_when: "not (('already installed' in pecl_result.stdout) or ('install ok:' in pecl_result.stdout))"
#   with_items:
#     - redis
#   when: ansible_os_family == "RedHat"

- name: Setup MISP Cake config
  ansible.builtin.copy:
    src: "{{ misp_rootdir }}/INSTALL/setup/config.php"
    dest: "{{ misp_rootdir }}/app/Plugin/CakeResque/Config/config.php"
    mode: '0644'
    remote_src: true
    backup: yes

- name: Validate permissions
  ansible.builtin.file:
    dest: "{{ item.f }}"
    mode: "{{ item.m }}"
    owner: "{{ www_user }}"
    group: "{{ www_user }}"
    state: "directory"
  with_items:
    - { f: "{{ misp_rootdir }}", m: '0755' }
    - { f: "{{ misp_rootdir }}/app/files", m: '2775' }
    - { f: "{{ misp_rootdir }}/app/files/scripts/tmp", m: '2775' }
    - { f: "{{ misp_rootdir }}/app/Plugin/CakeResque/tmp", m: '0775' }
    - { f: "{{ misp_rootdir }}/app/Config", m: '0750' }
    - { f: "{{ misp_rootdir }}/.gnupg", m: '0700' }
    - { f: "{{ misp_rootdir }}/app/webroot", m: '0700' }
- name: Check owner/group for multiple MISP folders
  ansible.builtin.file:
    dest: "{{ item }}"
    owner: "{{ www_user }}"
    group: "{{ www_user }}"
    state: directory
    mode: '02755'
  # with_fileglob:
  #   - {{ misp_rootdir }}/app/files/scripts/tmp/*
  #   - {{ misp_rootdir }}/app/files/scripts/tmp/cache/*
  #   - {{ misp_rootdir }}/app/files/scripts/tmp/cached_exports/*
  with_items:
    - "{{ misp_rootdir }}/app/tmp/"
    - "{{ misp_rootdir }}/app/tmp/sessions"
    - "{{ misp_rootdir }}/app/tmp/cache"
    - "{{ misp_rootdir }}/app/tmp/cache/models"
    - "{{ misp_rootdir }}/app/tmp/cache/persistent"
    - "{{ misp_rootdir }}/app/tmp/cache/views"
    - "{{ misp_rootdir }}/app/tmp/tests"
    - "{{ misp_rootdir }}/app/tmp/logs"
    - "{{ misp_rootdir }}/app/tmp/files"
    - "{{ misp_rootdir }}/app/tmp/cached_exports"
    - "{{ misp_rootdir }}/app/tmp/cached_exports/md5"
    - "{{ misp_rootdir }}/app/tmp/cached_exports/suricata"
    - "{{ misp_rootdir }}/app/tmp/cached_exports/text"
    - "{{ misp_rootdir }}/app/tmp/cached_exports/snort"
    - "{{ misp_rootdir }}/app/tmp/cached_exports/sha1"
    - "{{ misp_rootdir }}/app/tmp/cached_exports/csv_sig"
    - "{{ misp_rootdir }}/app/tmp/cached_exports/csv_all"
    - "{{ misp_rootdir }}/app/tmp/cached_exports/xml"
    - "{{ misp_rootdir }}/app/tmp/cached_exports/rpz"
- name: Check if debug.log exists
  ansible.builtin.stat:
    path: "{{ misp_rootdir }}/app/tmp/debug.log"
  register: debuglog
- name: Touch debug.log
  ansible.builtin.file:
    dest: "{{ misp_rootdir }}/app/tmp/debug.log"
    mode: '0644'
    owner: "{{ www_user }}"
    group: "{{ www_user }}"
    state: touch
  when: not debuglog.stat.exists

- name: Import mysql-configure
  ansible.builtin.import_tasks: mysql-configure.yml

- name: Extra php settings
  ansible.builtin.template:
    src: "misp-php.ini.j2"
    dest: "{{ php_confdir }}/misp-php.{{ php_confext }}"
    mode: "0644"
  notify:
    - Restart webserver
    - Restart webserver - docker,debian
    - Restart webserver - docker,redhat
- name: Enforce Timezone in php.ini
  ansible.builtin.replace:
    dest: "{{ php_ini }}"
    regexp: '^;date.timezone ='
    replace: 'date.timezone = {{ tz }}'
    mode: '0644'
  notify:
    - Restart webserver
    - Restart webserver - docker,debian
    - Restart webserver - docker,redhat
- name: Enabling MISP php settings
  ansible.builtin.file:
    src: "{{ php_confdir }}/misp-php.ini"
    dest: "{{ php_confenable }}/99-misp.ini"
    mode: '0644'
    state: link
  notify:
    - Restart webserver
    - Restart webserver - docker,debian
    - Restart webserver - docker,redhat
  when: >
    (ansible_distribution == 'Debian' or ansible_distribution == 'Ubuntu') and
    (misp_webserver is not defined or misp_webserver == 'apache2')

- name: Check if bootstrap.php exists
  ansible.builtin.stat:
    path: "{{ misp_rootdir }}/app/Config/bootstrap.php"
  register: conffiles
- name: Create config files from default
  ansible.builtin.copy:
    src: "{{ misp_rootdir }}/app/Config/{{ item }}.default.php"
    dest: "{{ misp_rootdir }}/app/Config/{{ item }}.php"
    mode: '0644'
    owner: "{{ www_user }}"
    remote_src: true
  with_items:
    - bootstrap
    - database
    - core
    ## done later
    # - config
  when: not conffiles.stat.exists and (ansible_distribution == 'Debian' or ansible_distribution == 'Ubuntu')
- name: Create config files from default
  ansible.builtin.copy:
    src: "{{ misp_rootdir }}/app/Config/{{ item }}.default.php"
    dest: "{{ misp_rootdir }}/app/Config/{{ item }}.php"
    mode: '0644'
    remote_src: true
  with_items:
    - bootstrap
    - database
    - core
    # - config
  when: not conffiles.stat.exists and not (ansible_distribution == 'Debian' or ansible_distribution == 'Ubuntu')
- name: Ensure right permissions for conf files
  ansible.builtin.file:
    dest: "{{ misp_rootdir }}/app/Config/{{ item }}.php"
    owner: "{{ www_user }}"
    mode: '0640'
  with_items:
    - bootstrap
    - database
    - core
    # - config

- name: Update database settings
  ansible.builtin.replace:
    dest: "{{ misp_rootdir }}/app/Config/database.php"
    regexp: "{{ item.regexp }}"
    replace: "{{ item.replace }}"
    mode: '0640'
  with_items:
    - { regexp: 'db login', replace: "{{ misp_db_user }}" }
    - { regexp: 'db password', replace: "{{ misp_db_pass }}" }
  no_log: "{{ misp_no_log }}"
- name: Set CakeResque bootstrap to true
  ansible.builtin.lineinfile:
    dest: "{{ misp_rootdir }}/app/Config/bootstrap.php"
    line: "CakePlugin::loadAll(array( 'CakeResque' => array('bootstrap' => true) ));"
    mode: '0640'
- name: Set Cache::Config - mask acceptable for snuffleupagus
  ansible.builtin.lineinfile:
    dest: "{{ misp_rootdir }}/app/Config/bootstrap.php"
    regexp: "^Cache::config.'default', array.'engine' => 'File'.*.;"
    line: "Cache::config('default', array( 'engine' => 'File', 'mask' => 0600 ));"
    mode: '0640'
    backup: yes
  when: misp_php_snuffleupagus_enable
- name: Set Cache::Config whole cakephp - mask acceptable for snuffleupagus  # noqa no-tabs
  ansible.builtin.lineinfile:
    dest: "{{ misp_rootdir }}/app/Lib/cakephp/lib/Cake/Cache/Engine/FileEngine.php"
    regexp: "^\t\t\t'mask' => .*"
    line: "\t\t\t'mask' => 0600"
    mode: '0644'
    backup: yes
  when: misp_php_snuffleupagus_enable
- name: Add vendor/autoload.php to core
  ansible.builtin.lineinfile:
    dest: "{{ misp_rootdir }}/app/Config/core.php"
    line: "{{ item }}"
    mode: '0640'
  with_items:
    - "require_once dirname(__DIR__) . '/Vendor/autoload.php';"

- name: Import random
  ansible.builtin.import_tasks: random.yml
  vars:
    secretdir: "{{ misp_rootdir }}"
    secretprefix: .misp-
    name_random: salt
- name: Set salt
  ansible.builtin.set_fact:
    salt: "{{ secret }}"
  no_log: "{{ misp_no_log }}"

- name: Import random
  ansible.builtin.import_tasks: random.yml
  vars:
    secretdir: "{{ misp_rootdir }}"
    secretprefix: .misp-
    name_random: encryption_key
- name: Set salt
  ansible.builtin.set_fact:
    salt2: "{{ secret }}"
  no_log: "{{ misp_no_log }}"

# FIXME! idempotence. MISP is rewriting this file regularly
- name: Updating MISP config with salt
  ansible.builtin.template:
    src: "{{ misp_config_php_template }}"
    dest: "{{ misp_rootdir }}/app/Config/config.php"
    mode: '0600'
    backup: yes
    owner: "{{ www_user }}"
  tags:
    - salt

- name: Check if webroot gpg.asc exists
  ansible.builtin.stat:
    path: "{{ misp_rootdir }}/app/webroot/gpg.asc"
  register: gkey
- name: Create gpg configuration template
  ansible.builtin.template:
    src: "gpg-template.j2"
    dest: "/var/tmp/gpg-template"
    owner: "{{ www_user }}"
    mode: "0600"
  when: not gkey.stat.exists
- name: Redhat | start gpg-agent
  ansible.builtin.command:  # noqa no-changed-when
    cmd: "gpg-agent --daemon --homedir={{ misp_rootdir }}/.gnupg"
  become: yes
  become_user: "{{ www_user }}"
  when: not gkey.stat.exists and (ansible_os_family == "RedHat") and misp_webserver == 'nginx'
- name: Create gnupg key for {{ misp_email }}
  ansible.builtin.command: "{{ item.s }}"
  args:
    chdir: "{{ misp_rootdir }}/.gnupg"
    creates: "{{ item.c }}"
  with_items:
    - { s: "gpg --homedir {{ misp_rootdir }}/.gnupg --gen-key --batch /var/tmp/gpg-template",
        c: "{{ misp_rootdir }}/.gnupg/misp.pub"
    }
    - { s: "gpg --homedir {{ misp_rootdir }}/.gnupg --batch --import {{ misp_rootdir }}/.gnupg/misp.pub",
        c: "{{ misp_rootdir }}/app/webroot/gpg.asc"
    }
    # - { s: "gpg --homedir {{ misp_rootdir }}/.gnupg --batch --import {{ gnupg_privdir }}/misp.sec",
    #     c: "{{ misp_rootdir }}/app/webroot/gpg.asc"
    # }
  become: yes
  become_user: "{{ www_user }}"
- name: Create gnupg key for {{ misp_email }}
  ansible.builtin.shell: >
    gpg --homedir {{ misp_rootdir }}/.gnupg --export --armor {{ misp_email }} --batch > {{ misp_rootdir }}/app/webroot/gpg.asc
  args:
    chdir: "{{ misp_rootdir }}/.gnupg"
    creates: "{{ misp_rootdir }}/app/webroot/gpg.asc"
  become: yes
  become_user: "{{ www_user }}"
## it seems to be done by gpg
# - command: wipe -q -y /var/tmp/gpg-template
#   when: not gkey.stat.exists
- name: Check permissions of gpg files
  ansible.builtin.file:
    dest: "{{ item.d }}"
    mode: "{{ item.m }}"
  with_items:
    - { d: "{{ misp_rootdir }}/.gnupg/misp.pub", m: '0400' }
    # - { d: "{{ gnupg_privdir }}/misp.sec", m: '0400' }
    - { d: "{{ misp_rootdir }}/.gnupg/pubring.gpg", m: '0600' }
    - { d: "{{ misp_rootdir }}/.gnupg/secring.gpg", m: '0600' }
  when: >
    not (
          (ansible_distribution == 'Debian' and ansible_distribution_major_version | int >= 11) or
          (ansible_distribution == 'Ubuntu' and ansible_distribution_major_version | int >= 18) or
          (ansible_os_family == "RedHat" and ansible_distribution_major_version | int >= 8)
        )

- name: Import redhat-logrotate
  ansible.builtin.import_tasks: redhat-logrotate.yml
  when: ansible_os_family == "RedHat"

- name: Import selinux-context
  ansible.builtin.import_tasks: selinux-context.yml
  when: ansible_os_family == "RedHat" and ansible_selinux.status is defined and ansible_selinux.status != 'disabled'

- name: Ubuntu Xenial Docker
  when: >
    ansible_virtualization_type is defined and ansible_virtualization_type == "docker"
    and ansible_distribution == "Ubuntu" and ansible_distribution_release == 'xenial'
  block:
    - name: Docker redis workaround ???
      ansible.builtin.replace:
        dest: /etc/systemd/system/redis.service
        regexp: "{{ item.re }}"
        replace: "{{ item.rep }}"
        mode: '0644'
        backup: yes
      with_items:
        - { re: '^PrivateTmp=yes', rep: 'PrivateTmp=no' }
        - { re: '^PrivateDevices=yes', rep: 'PrivateDevices=no' }
        # - { re: '^', rep: '' }
- name: Ensure redis is active before launching worker
  ansible.builtin.service:
    name: "{{ redis_svc }}"
    state: started
    enabled: yes
  when: not (ansible_virtualization_type is defined and ansible_virtualization_type == "docker")

- name: Docker | Manually start redis
  ansible.builtin.shell: "/usr/bin/redis-server {{ redis_conf }} --daemonize yes > /tmp/redis.out"
  become: yes
  become_user: redis
  become_flags: -H
  args:
    creates: /tmp/redis.out
  when: (ansible_virtualization_type is defined and ansible_virtualization_type == "docker")

# snuffleupagus sp.readonly_exec.enable() = php file must be non-writeable (issue with auto-update?)
- name: Ensure that webroot files are not executable and not writeable
  ansible.builtin.command: "find {{ misp_rootdir }}/app/ -type f -iname '{{ item }}' ! -path {{ misp_rootdir }}/app/Config/config.php ! -name include_paths.php ! -path {{ misp_rootdir }}/app/Config/bootstrap.php ! -path {{ misp_rootdir }}/app/Config/database.php ! -path {{ misp_rootdir }}/app/Config/core.php ! -path {{ misp_rootdir }}/app/Config/email.php ! -path {{ misp_rootdir }}/app/Vendor/ -exec chmod 0444 {} \\;"  # noqa no-changed-when
  with_items:
    - '*.php'
    - '*.ctp'
  when: misp_php_snuffleupagus_enable
- name: Ensure config files are writeable by www user but not the world
  ansible.builtin.file:
    dest: "{{ item }}"
    owner: "{{ www_user }}"
    group: root
    mode: '0640'
  loop:
    - "{{ misp_rootdir }}/app/Config/bootstrap.php"
    - "{{ misp_rootdir }}/app/Config/config.php"
    - "{{ misp_rootdir }}/app/Config/core.php"
    - "{{ misp_rootdir }}/app/Config/database.php"
    - "{{ misp_rootdir }}/app/Config/email.php"
- name: Backup cakephp
  ansible.builtin.command: >
    cp -R {{ misp_rootdir }}/app/Lib/cakephp {{ misp_rootdir }}/app/Lib/cakephp.orig
  args:
    creates: "{{ misp_rootdir }}/app/Lib/cakephp.orig"
  when: misp_testing is defined and misp_testing
- name: Backup MISP
  ansible.builtin.copy:
    src: "{{ misp_rootdir }}/app/Controller/AppController.php"
    dest: "{{ misp_rootdir }}/app/Controller/AppController.php.orig"
    mode: '0644'
    remote_src: true
  when: misp_testing is defined and misp_testing
- name: Patch cakephp with stricter casting to support sp.global_strict
  ansible.posix.patch:
    src: "{{ item.s }}"
    basedir: "{{ item.b }}"
  with_items:
    - { s: patch-cakephp-snuffleupagus-strict, b: "{{ misp_rootdir }}/app/Lib" }
    - { s: patch-app-Lib-cakephp-lib-Cake-Model-Datasource-Database, b: "{{ misp_rootdir }}/app/Lib/cakephp/lib/Cake/Model/Datasource/Database" }
    - { s: patch-app-Lib-Cackephp-lib-Cake-Core-Configure_php, b: "{{ misp_rootdir }}/app/Lib/cakephp/lib/Cake/Core" }
    - { s: patch-app-Lib-Cackephp-lib-Cake-Network-CakeRequest_php, b: "{{ misp_rootdir }}/app/Lib/cakephp/lib/Cake/Network" }
    - { s: patch-app-Lib-Cackephp-lib-Cake-Model-Datasource-Database-Mysql_php, b: "{{ misp_rootdir }}/app/Lib/cakephp/lib/Cake/Model/Datasource/Database" }
    - { s: patch-app-Lib-Cackephp-lib-Cake-Model-Datasource-DboSource_php, b: "{{ misp_rootdir }}/app/Lib/cakephp/lib/Cake/Model/Datasource" }
    - { s: patch-app-Lib-Cackephp-lib-cakephp-lib-Cake-Model-Datasource-CakeSession_php, b: "{{ misp_rootdir }}/app/Lib/cakephp/lib/Cake/Model/Datasource" }
  when: misp_php_snuffleupagus_enable
- name: Patch kamisama/php-resque-ex with stricter casting to support sp.global_strict
  ansible.posix.patch:
    src: patch-php-resque-ex-master-lib-Resque-Redis.php
    basedir: "{{ misp_rootdir }}/app/Vendor/kamisama/php-resque-ex/lib/Resque"
  when: misp_php_snuffleupagus_enable

- name: Import lief
  ansible.builtin.import_tasks: lief.yml
  when: misp_lief_enable

- name: Import misp-modules
  ansible.builtin.import_tasks: misp-modules.yml
  when: misp_modules_enable|bool
- name: Import misp-gem
  ansible.builtin.import_tasks: misp-gem.yml

- name: Import background-jobs
  ansible.builtin.import_tasks: background-jobs.yml
  when: >
    (
      (ansible_distribution == 'Ubuntu' and ansible_distribution_major_version | int >= 20) or
      (ansible_os_family == "RedHat" and ansible_distribution_major_version | int >= 8)
    )

- name: Import testing
  ansible.builtin.import_tasks: testing.yml
  when: misp_testing is defined and misp_testing

- name: Import misp-add-users
  ansible.builtin.import_tasks: misp-add-users.yml

- name: Import misp-run-updates
  ansible.builtin.import_tasks: misp-run-updates.yml
  when: misp_run_updates is defined and misp_run_updates

- name: Import misp-feed
  ansible.builtin.import_tasks: misp-feeds.yml

## or use tools/misp-backup/misp-backup.sh ?
- name: Ensure scriptsdir directory exists
  ansible.builtin.file:
    path: "{{ scriptsdir }}"
    state: "directory"
    mode: "0755"
- name: Add backup script
  ansible.builtin.template:
    src: "backup-misp.sh.j2"
    dest: "{{ scriptsdir }}/backup-misp.sh"
    mode: "0755"
- name: Add restore script
  ansible.builtin.template:
    src: "restore-misp.sh.j2"
    dest: "{{ scriptsdir }}/restore-misp.sh"
    mode: "0755"
- name: Setup cron backup
  ansible.builtin.cron:
    name: "misp-backup"
    minute: "30"
    hour: "3"
    weekday: "0"
    job: "{{ scriptsdir }}/backup-misp.sh > /dev/null 2>&1"
    user: root
    cron_file: ansible_misp-backup