---
################################################################################
# Created Date: Sunday December 21st 2025
# Author: Aaron Johnson aaron.johnson@akamai.com
# -----
# Last Modified: Sunday, 21st December 2025
# Modified By: the engineer formerly known as Aaron Johnson
# -----
# Copyright (c) 2025 Contact Author for details
# -----
# USAGE/DOCUMENTATION:
# 
# -----
# INSTALLATION
# 
# -----
# HISTORY:
# Date      	By	Comments
# ----------	---	---------------------------------------------------------
################################################################################

- name: Allow acme user to reload apache without password
  copy:
    dest: /etc/sudoers.d/acme-apache
    content: |
      {{ acme_user }} ALL=NOPASSWD: /bin/systemctl reload {{ apache_service }}
    mode: "0440"
    owner: root
    group: root

- name: Allow Apache to read cert directory (SELinux)
  command: semanage fcontext -a -t httpd_config_t "{{ cert_dir }}(/.*)?"
  args:
    creates: "/etc/selinux/targeted/contexts/files/file_contexts.local"

# - name: Apply SELinux labels
#   command: restorecon -Rv "{{ cert_dir }}"

- name: Apply SELinux labels only if incorrect
  command: restorecon -Rv "{{ cert_dir }}"
  register: restorecon_result
  changed_when: restorecon_result.stdout_lines | select("search", "Relabeled") | list | length > 0