---
- name: Install nginx
  become: true
  ansible.builtin.dnf:
    name: nginx
    state: present

- name: Deploy nginx.conf
  become: true
  ansible.builtin.template:
    src: nginx.conf.j2
    dest: /etc/nginx/nginx.conf
    mode: "0644"
    owner: root
    group: root
  notify: Reload nginx

- name: Deploy server blocks configuration
  become: true
  ansible.builtin.template:
    src: nginx-server.conf.j2
    dest: /etc/nginx/conf.d/nginx-proxy.conf
    mode: "0644"
    owner: root
    group: root
  notify: Reload nginx

- name: Enable and start nginx
  become: true
  ansible.builtin.systemd:
    name: nginx
    state: started
    enabled: true
    daemon_reload: true

- name: Set SELinux context for Let's Encrypt certificates
  become: true
  ansible.builtin.command: >-
    semanage fcontext -a -t httpd_cert_t "/etc/letsencrypt(/.*)?"
  failed_when: false
  changed_when: false

- name: Restore SELinux context for Let's Encrypt directory
  become: true
  ansible.builtin.command: restorecon -Rv /etc/letsencrypt
  changed_when: false

- name: Set SELinux boolean to allow nginx to connect to any port
  become: true
  ansible.builtin.command: semanage boolean -m --on nginx_connect_any
  failed_when: false
  changed_when: false
  when: ansible_selinux.status == "enabled"

- name: Add oauth2-proxy port to SELinux http_port_t
  become: true
  ansible.builtin.command: >-
    semanage port -a -t http_port_t -p tcp {{ nginx_proxy_oauth2_proxy_port }}
  failed_when: false
  changed_when: false
  when: ansible_selinux.status == "enabled"