- name: Require completed Atlas firewall placeholders
  tags: [atlas, sharing, services]
  ansible.builtin.assert:
    that:
      - atlas_lan_subnet != 'CHANGEME_LAN_SUBNET'
      - atlas_aegis_ip != 'CHANGEME_AEGIS_IP'
      - atlas_firewalld_zone | length > 0
      - ansible_facts.default_ipv4.interface | default('') | length > 0
    fail_msg: Replace the Atlas LAN, Aegis and firewall-zone placeholders.
  when: atlas_manage_firewall | bool

- name: Apply Atlas firewalld rich rules
  tags: [atlas, sharing, services]
  ansible.posix.firewalld:
    rich_rule: "{{ item }}"
    permanent: true
    immediate: true
    state: enabled
    zone: "{{ atlas_firewalld_zone }}"
  loop: "{{ atlas_firewalld_rich_rules }}"
  loop_control:
    label: "{{ item }}"
  when: atlas_manage_firewall | bool

- name: Assign primary Atlas LAN interface to managed firewalld zone
  tags: [atlas, sharing, services]
  ansible.posix.firewalld:
    interface: "{{ ansible_facts.default_ipv4.interface }}"
    zone: "{{ atlas_firewalld_zone }}"
    state: enabled
    permanent: true
    immediate: true
  when: atlas_manage_firewall | bool

- name: Remove unrestricted Atlas services from firewalld zone
  tags: [atlas, sharing, services]
  ansible.posix.firewalld:
    service: "{{ item }}"
    permanent: true
    immediate: true
    state: disabled
    zone: "{{ atlas_firewalld_zone }}"
  loop: "{{ atlas_firewalld_restricted_services }}"
  loop_control:
    label: "{{ item }}"
  when: atlas_manage_firewall | bool

- name: Render Atlas NFS exports
  tags: [atlas, sharing]
  ansible.builtin.template:
    src: atlas.exports.j2
    dest: /etc/exports.d/atlas.exports
    owner: root
    group: root
    mode: "0644"
  notify: Reload NFS exports
  when: atlas_manage_sharing | bool

- name: Ensure Atlas NFS configuration drop-in directory exists
  tags: [atlas, sharing]
  ansible.builtin.file:
    path: /etc/nfs.conf.d
    state: directory
    owner: root
    group: root
    mode: "0755"
  when: atlas_manage_sharing | bool

- name: Configure Atlas NFSv4-only service
  tags: [atlas, sharing]
  ansible.builtin.template:
    src: atlas-nfs.conf.j2
    dest: /etc/nfs.conf.d/atlas.conf
    owner: root
    group: root
    mode: "0644"
  notify: Restart NFS server
  when: atlas_manage_sharing | bool

- name: Mask Atlas NFSv3 RPC services
  tags: [atlas, sharing, services]
  ansible.builtin.systemd:
    name: "{{ item }}"
    enabled: false
    state: stopped
    masked: true
  loop:
    - rpc-statd.service
    - rpcbind.service
    - rpcbind.socket
  loop_control:
    label: "{{ item }}"
  when: atlas_manage_sharing | bool

- name: Ensure Atlas NFS mount daemon drop-in directory exists
  tags: [atlas, sharing, services]
  ansible.builtin.file:
    path: /etc/systemd/system/nfs-mountd.service.d
    state: directory
    owner: root
    group: root
    mode: "0755"
  when: atlas_manage_sharing | bool

- name: Disable Atlas NFSv3 mount daemon listeners
  tags: [atlas, sharing, services]
  ansible.builtin.template:
    src: nfs-mountd-v4only.conf.j2
    dest: /etc/systemd/system/nfs-mountd.service.d/v4only.conf
    owner: root
    group: root
    mode: "0644"
  notify: Restart NFS mount daemon
  when: atlas_manage_sharing | bool

- name: Enable SELinux access for Atlas file sharing
  tags: [atlas, sharing, services]
  ansible.posix.seboolean:
    name: "{{ item }}"
    state: true
    persistent: true
  loop: "{{ atlas_selinux_booleans }}"
  loop_control:
    label: "{{ item }}"
  when:
    - atlas_manage_sharing | bool
    - (ansible_facts['selinux'] | default({})).get('status', 'disabled') == 'enabled'

- name: Render Atlas Samba configuration
  tags: [atlas, sharing]
  ansible.builtin.template:
    src: smb.conf.j2
    dest: /etc/samba/smb.conf
    owner: root
    group: root
    mode: "0644"
    validate: "testparm --suppress-prompt %s"
  notify: Restart Samba service
  when: atlas_manage_sharing | bool

- name: Require Vault-backed Atlas Samba accounts
  tags: [atlas, sharing]
  ansible.builtin.assert:
    that:
      - atlas_samba_encryption in ['required', 'desired']
      - atlas_samba_accounts | length > 0
      - >-
        atlas_samba_accounts | map(attribute='username') | list
        | difference(atlas_samba_valid_users) | length == 0
      - >-
        atlas_samba_valid_users
        | difference(atlas_samba_accounts | map(attribute='username') | list) | length == 0
      - atlas_samba_accounts | selectattr('password', 'equalto', '') | list | length == 0
    fail_msg: Define every authorized Samba account and its Vault-backed password.
  no_log: true
  when: atlas_manage_sharing | bool

- name: Ensure Atlas Samba private state directory exists
  tags: [atlas, sharing]
  ansible.builtin.file:
    path: "{{ atlas_samba_password_marker_dir }}"
    state: directory
    owner: root
    group: root
    mode: "0700"
  when: atlas_manage_sharing | bool

- name: Manage Vault-backed Atlas Samba credentials
  tags: [atlas, sharing]
  ansible.builtin.include_tasks: samba_account.yml
  loop: "{{ atlas_samba_accounts }}"
  loop_control:
    loop_var: atlas_samba_account
    label: "{{ atlas_samba_account.username }}"
  no_log: true
  when: atlas_manage_sharing | bool

- name: Enable Atlas file-sharing services
  tags: [atlas, sharing, services]
  ansible.builtin.systemd:
    name: "{{ item }}"
    enabled: true
    state: started
  loop:
    - nfs-server.service
    - smb.service
  loop_control:
    label: "{{ item }}"
  when: atlas_manage_sharing | bool

- name: Gather effective Atlas firewalld zone configuration
  tags: [atlas, sharing, services, security]
  ansible.posix.firewalld_info:
    zones:
      - "{{ atlas_firewalld_zone }}"
  register: atlas_firewalld_info
  when:
    - atlas_manage_firewall | bool
    - not ansible_check_mode

- name: Verify effective Atlas firewalld restrictions
  tags: [atlas, sharing, services, security]
  ansible.builtin.assert:
    that:
      - atlas_firewalld_zone in atlas_firewalld_info.firewalld_info.zones
      - >-
        ansible_facts.default_ipv4.interface
        in atlas_firewalld_info.firewalld_info.zones[atlas_firewalld_zone].interfaces
      - >-
        atlas_firewalld_restricted_services
        | intersect(atlas_firewalld_info.firewalld_info.zones[atlas_firewalld_zone].services)
        | length == 0
    fail_msg: >-
      The effective Atlas firewalld zone does not restrict the primary LAN
      interface and unmanaged service exposure as declared.
  when:
    - atlas_manage_firewall | bool
    - not ansible_check_mode

- name: Apply pending Atlas sharing handlers before verification
  tags: [atlas, sharing, services, security]
  ansible.builtin.meta: flush_handlers
  when:
    - atlas_manage_sharing | bool
    - not ansible_check_mode

- name: Check active Atlas file-sharing services
  tags: [atlas, sharing, services, security]
  ansible.builtin.command:
    argv:
      - systemctl
      - is-active
      - --quiet
      - "{{ item }}"
  loop:
    - nfs-server.service
    - smb.service
  loop_control:
    label: "{{ item }}"
  register: atlas_file_sharing_service_activity
  changed_when: false
  failed_when: false
  when:
    - atlas_manage_sharing | bool
    - not ansible_check_mode

- name: Require active Atlas file-sharing services
  tags: [atlas, sharing, services, security]
  ansible.builtin.assert:
    that:
      - atlas_file_sharing_service_activity.results | map(attribute='rc') | list == [0, 0]
    fail_msg: Atlas NFSv4 or SMB3 did not start after its managed configuration was applied.
  when:
    - atlas_manage_sharing | bool
    - not ansible_check_mode

- name: Require Atlas file-sharing TCP listeners
  tags: [atlas, sharing, services, security]
  ansible.builtin.wait_for:
    host: 127.0.0.1
    port: "{{ item }}"
    state: started
    timeout: 15
  loop:
    - 2049
    - 445
  loop_control:
    label: "{{ item }}/tcp"
  when:
    - atlas_manage_sharing | bool
    - not ansible_check_mode