---
- name: Debian family AIDE installation
  become: true
  ansible.builtin.apt:
    name: aide-common
    state: present
    install_recommends: false
  when: ansible_os_family == "Debian"
  tags:
    - aide
    - CIS-UBUNTU2004-1.3.1

- name: RedHat family AIDE package installation
  become: true
  ansible.builtin.package:
    name: aide
    state: present
  when: ansible_os_family == "RedHat"
  tags:
    - aide
    - CCE-80844-4

- name: Stat AIDE cron.daily
  become: true
  ansible.builtin.stat:
    path: /etc/cron.daily/aide
  register: aidecron
  tags:
    - aide
    - CCE-80844-4
    - CIS-UBUNTU2004-1.3.1

- name: Install AIDE service
  become: true
  ansible.builtin.template:
    src: lib/systemd/system/aidecheck.service.j2
    dest: /lib/systemd/system/aidecheck.service
    backup: true
    mode: "0644"
    owner: root
    group: root
  when: not aidecron.stat.exists
  tags:
    - aide

- name: Install AIDE timer
  become: true
  ansible.builtin.template:
    src: lib/systemd/system/aidecheck.timer.j2
    dest: /lib/systemd/system/aidecheck.timer
    backup: true
    mode: "0644"
    owner: root
    group: root
  when: not aidecron.stat.exists
  notify:
    - Reload systemd
    - Enable aidecheck
  tags:
    - aide
    - CCE-80676-0
    - CIS-UBUNTU2004-1.3.2

- name: Add AIDE Debian dir exclusions
  become: true
  ansible.builtin.blockinfile:
    path: /etc/aide/aide.conf
    marker: "# {mark} ANSIBLE MANAGED BLOCK"
    backup: true
    insertafter: EOF
    block: |
      {% for exclude in _aide_exclude %}
      {{ exclude }}
      {% endfor %}
  when: ansible_os_family == "Debian"
  tags:
    - aide

- name: Stat Debian aide.db
  become: true
  ansible.builtin.stat:
    path: /var/lib/aide/aide.db
  register: ubuaidedb
  when: ansible_os_family == "Debian"
  tags:
    - aide

- name: Add AIDE RedHat dir exclusions
  become: true
  ansible.builtin.blockinfile:
    path: /etc/aide.conf
    marker: "# {mark} ANSIBLE MANAGED BLOCK"
    backup: true
    insertafter: EOF
    block: |
      !/var/lib/docker
      !/var/lib/lxcfs
      !/var/lib/private/systemd
      !/var/log/audit
      !/var/log/journal
  when: ansible_os_family == "RedHat"
  tags:
    - aide

- name: Stat RedHat aide.db
  become: true
  ansible.builtin.stat:
    path: /var/lib/aide/aide.db.gz
  register: rhelaidedb
  changed_when: false
  failed_when: false
  when: ansible_os_family == "RedHat"
  tags:
    - aide

- name: Initialize RedHat AIDE
  become: true
  ansible.builtin.command:
    cmd: aide --init -B 'database_out=file:/var/lib/aide/aide.db.gz'
  register: init_redhat_aide
  changed_when: init_redhat_aide.rc != 0
  failed_when: init_redhat_aide.rc != 0
  when: ansible_os_family == "RedHat" and not rhelaidedb.stat.exists
  tags:
    - aide
    - CCE-80675-2

- name: Stat RedHat aide.db.new.gz
  become: true
  ansible.builtin.stat:
    path: /var/lib/aide/aide.db.new.gz
  register: rhelaidedbnew
  changed_when: false
  failed_when: false
  when: ansible_os_family == "RedHat"
  tags:
    - aide

- name: Copy RedHat AIDE database
  become: true
  ansible.builtin.command:
    cmd: cp /var/lib/aide/aide.db.gz /var/lib/aide/aide.db.new.gz
  register: cp_redhat_aide_db
  changed_when: cp_redhat_aide_db.rc != 0
  failed_when: cp_redhat_aide_db.rc != 0
  when: ansible_os_family == "RedHat" and not rhelaidedbnew.stat.exists
  tags:
    - aide

- name: Initialize Debian AIDE
  become: true
  ansible.builtin.command:
    cmd: aideinit --force --yes
  register: init_debian_aide
  changed_when: init_debian_aide.rc != 0
  failed_when: init_debian_aide.rc != 0
  when: ansible_os_family == "Debian" and not ubuaidedb.stat.exists
  tags:
    - aide