---

- name: "Secure apache infos"
  ansible.builtin.replace:
    path: /etc/apache2/conf-enabled/security.conf
    regexp: '^ServerTokens .*$'
    replace: 'ServerTokens Prod'
  become: true

- name: "Secure apache dir access"
  ansible.builtin.replace:
    path: /etc/apache2/mods-enabled/dir.conf
    regexp: '^DirectoryIndex .*$'
    replace: 'DirectoryIndex index.html index.htm'
  become: true

- name: "Insert ServerName"
  ansible.builtin.blockinfile:
    path: "/etc/apache2/apache2.conf"
    block: "ServerName {{ domain }}"
    insertafter: '^#ServerRoot "/etc/apache2"'
    marker: "# {mark} ANSIBLE MANAGED BLOCK #"
  become: true

- name: "Insert Mail"
  ansible.builtin.replace:
    path: "/etc/apache2/sites-enabled/000-default.conf"
    regexp: "ServerAdmin .*"
    replace: "ServerAdmin {{ email }}"
  become: true

- name: "Insert Mail"
  ansible.builtin.replace:
    path: "/etc/apache2/sites-available/default-ssl.conf"
    regexp: "ServerAdmin .*"
    replace: "ServerAdmin {{ email }}"
  become: true

- name: "Register https"
  ansible.builtin.command: "certbot -n -m {{ email }} --agree-tos --apache -d {{ domain }}"
  changed_when: false
  become: true

- name: "Replace SSLCertificateFile"
  ansible.builtin.replace:
    path: "/etc/apache2/sites-available/default-ssl.conf"
    regexp: ".*SSLCertificateFile .*"
    replace: "    SSLCertificateFile /etc/letsencrypt/live/{{ domain }}/cert.pem"
  become: true

- name: "Replace SSLCertificateKeyFile"
  ansible.builtin.replace:
    path: "/etc/apache2/sites-available/default-ssl.conf"
    regexp: ".*SSLCertificateKeyFile .*"
    replace: "    SSLCertificateKeyFile /etc/letsencrypt/live/{{ domain }}/privkey.pem"
  become: true

- name: "Replace SSLCertificateChainFile"
  ansible.builtin.replace:
    path: "/etc/apache2/sites-available/default-ssl.conf"
    regexp: ".*SSLCertificateChainFile .*"
    replace: "    SSLCertificateChainFile /etc/letsencrypt/live/{{ domain }}/chain.pem"
  become: true

- name: "Enable ssl"
  ansible.builtin.command: a2ensite default-ssl
  changed_when: false
  become: true