---
- name: Render Atlas NFS exports
  tags: [atlas, sharing]
  ansible.builtin.template:
    src: atlas.exports.j2
    dest: /etc/exports.d/atlas.exports
    owner: root
    group: root
    mode: "0644"
  notify: Reload NFS exports
  when: atlas_manage_storage | bool

- name: Enable Atlas file-sharing services
  tags: [atlas, sharing, services]
  ansible.builtin.systemd:
    name: "{{ item }}"
    enabled: true
    state: started
  loop:
    - nfs-server.service
    - smb.service
  loop_control:
    label: "{{ item }}"
  when: atlas_manage_storage | bool

- name: Configure Atlas NFSv4-only service
  tags: [atlas, sharing]
  ansible.builtin.template:
    src: atlas-nfs.conf.j2
    dest: /etc/nfs.conf.d/atlas.conf
    owner: root
    group: root
    mode: "0644"
  notify: Restart NFS server
  when: atlas_manage_storage | bool

- name: Mask Atlas NFSv3 RPC services
  tags: [atlas, sharing, services]
  ansible.builtin.systemd:
    name: "{{ item }}"
    enabled: false
    state: stopped
    masked: true
  loop:
    - rpc-statd.service
    - rpcbind.service
    - rpcbind.socket
  loop_control:
    label: "{{ item }}"
  when: atlas_manage_storage | bool

- name: Ensure Atlas NFS mount daemon drop-in directory exists
  tags: [atlas, sharing, services]
  ansible.builtin.file:
    path: /etc/systemd/system/nfs-mountd.service.d
    state: directory
    owner: root
    group: root
    mode: "0755"
  when: atlas_manage_storage | bool

- name: Disable Atlas NFSv3 mount daemon listeners
  tags: [atlas, sharing, services]
  ansible.builtin.template:
    src: nfs-mountd-v4only.conf.j2
    dest: /etc/systemd/system/nfs-mountd.service.d/v4only.conf
    owner: root
    group: root
    mode: "0644"
  notify: Restart NFS mount daemon
  when: atlas_manage_storage | bool

- name: Enable SELinux access for Atlas file sharing
  tags: [atlas, sharing, services]
  ansible.posix.seboolean:
    name: "{{ item }}"
    state: true
    persistent: true
  loop: "{{ atlas_selinux_booleans }}"
  loop_control:
    label: "{{ item }}"
  when:
    - atlas_manage_storage | bool
    - (ansible_facts['selinux'] | default({})).get('status', 'disabled') == 'enabled'

- name: Render Atlas Samba configuration
  tags: [atlas, sharing]
  ansible.builtin.template:
    src: smb.conf.j2
    dest: /etc/samba/smb.conf
    owner: root
    group: root
    mode: "0644"
    validate: "testparm --suppress-prompt %s"
  notify: Restart Samba service
  when: atlas_manage_storage | bool

- name: Require Vault-backed Atlas Samba accounts
  tags: [atlas, sharing]
  ansible.builtin.assert:
    that:
      - atlas_samba_accounts | length > 0
      - >-
        atlas_samba_accounts | map(attribute='username') | list
        | difference(atlas_samba_valid_users) | length == 0
      - >-
        atlas_samba_valid_users
        | difference(atlas_samba_accounts | map(attribute='username') | list) | length == 0
      - atlas_samba_accounts | selectattr('password', 'equalto', '') | list | length == 0
    fail_msg: Define every authorized Samba account and its Vault-backed password.
  no_log: true
  when: atlas_manage_storage | bool

- name: Ensure Atlas Samba private state directory exists
  tags: [atlas, sharing]
  ansible.builtin.file:
    path: "{{ atlas_samba_password_marker_dir }}"
    state: directory
    owner: root
    group: root
    mode: "0700"
  when: atlas_manage_storage | bool

- name: Manage Vault-backed Atlas Samba credentials
  tags: [atlas, sharing]
  ansible.builtin.include_tasks: samba_account.yml
  loop: "{{ atlas_samba_accounts }}"
  loop_control:
    loop_var: atlas_samba_account
    label: "{{ atlas_samba_account.username }}"
  no_log: true
  when: atlas_manage_storage | bool

- name: Require completed Atlas firewall placeholders
  tags: [atlas, sharing, services]
  ansible.builtin.assert:
    that:
      - atlas_lan_subnet != 'CHANGEME_LAN_SUBNET'
      - atlas_aegis_ip != 'CHANGEME_AEGIS_IP'
      - atlas_firewalld_zone | length > 0
    fail_msg: Replace the Atlas LAN, Aegis and firewall-zone placeholders.
  when: atlas_manage_firewall | bool

- name: Apply Atlas firewalld rich rules
  tags: [atlas, sharing, services]
  ansible.posix.firewalld:
    rich_rule: "{{ item }}"
    permanent: true
    immediate: true
    state: enabled
    zone: "{{ atlas_firewalld_zone }}"
  loop: "{{ atlas_firewalld_rich_rules }}"
  loop_control:
    label: "{{ item }}"
  when: atlas_manage_firewall | bool

- name: Remove unrestricted Atlas services from firewalld zone
  tags: [atlas, sharing, services]
  ansible.posix.firewalld:
    service: "{{ item }}"
    permanent: true
    immediate: true
    state: disabled
    zone: "{{ atlas_firewalld_zone }}"
  loop: "{{ atlas_firewalld_restricted_services }}"
  loop_control:
    label: "{{ item }}"
  when: atlas_manage_firewall | bool