- name: Install Remote Worker
  hosts: workers
  become: true
  tasks:
    # CentOS Stream 9
    - name: Install epel-release on CentOS Stream 9
      ansible.builtin.dnf:
        name: epel-release
        state: present
      when: ansible_distribution == "CentOS" and ansible_distribution_major_version|int == 9

    - name: Enable CRB on CentOS Stream 9
      ansible.builtin.command: dnf config-manager --set-enabled crb
      when: ansible_distribution == "CentOS" and ansible_distribution_major_version|int == 9
      changed_when: false

    # RHEL 8
    - name: Check for RHUI on RHEL 8
      ansible.builtin.shell: rpm -qa | grep -qE '(rh-amazon-rhui-client|rhui-azure-rhel|google-rhui-client)' && echo 'rhui' || echo 'standard'
      register: rhel8_rhui_check
      when: ansible_distribution == "RedHat" and ansible_distribution_major_version|int == 8
      changed_when: false
      failed_when: false

    - name: Install epel-release on RHEL 8
      ansible.builtin.dnf:
        name: "https://dl.fedoraproject.org/pub/epel/epel-release-latest-8.noarch.rpm"
        state: present
        disable_gpg_check: true
      when: ansible_distribution == "RedHat" and ansible_distribution_major_version|int == 8

    - name: Enable CRB on RHEL 8 (standard RHEL)
      ansible.builtin.command: subscription-manager repos --enable codeready-builder-for-rhel-8-x86_64-rpms
      when: ansible_distribution == "RedHat" and ansible_distribution_major_version|int == 8 and rhel8_rhui_check.stdout == "standard"
      changed_when: false
      failed_when: false

    - name: Enable CRB on RHEL 8 (RHUI)
      ansible.builtin.shell: |
        yum-config-manager --enable rhui-codeready-builder-for-rhel-8-rhui-rpms 2>/dev/null || \
        yum-config-manager --enable codeready-builder-for-rhel-8-rhui-rpms 2>/dev/null || true
      when: ansible_distribution == "RedHat" and ansible_distribution_major_version|int == 8 and rhel8_rhui_check.stdout == "rhui"
      changed_when: false

    # RHEL 9
    - name: Check for RHUI on RHEL 9
      ansible.builtin.shell: rpm -qa | grep -qE '(rh-amazon-rhui-client|rhui-azure-rhel|google-rhui-client)' && echo 'rhui' || echo 'standard'
      register: rhel9_rhui_check
      when: ansible_distribution == "RedHat" and ansible_distribution_major_version|int == 9
      changed_when: false
      failed_when: false

    - name: Install epel-release on RHEL 9
      ansible.builtin.dnf:
        name: "https://dl.fedoraproject.org/pub/epel/epel-release-latest-9.noarch.rpm"
        state: present
        disable_gpg_check: true
      when: ansible_distribution == "RedHat" and ansible_distribution_major_version|int == 9

    - name: Enable CRB on RHEL 9 (standard RHEL)
      ansible.builtin.command: subscription-manager repos --enable codeready-builder-for-rhel-9-x86_64-rpms
      when: ansible_distribution == "RedHat" and ansible_distribution_major_version|int == 9 and rhel9_rhui_check.stdout == "standard"
      changed_when: false
      failed_when: false

    - name: Enable CRB on RHEL 9 (RHUI)
      ansible.builtin.shell: |
        yum-config-manager --enable rhui-codeready-builder-for-rhel-9-rhui-rpms 2>/dev/null || \
        yum-config-manager --enable codeready-builder-for-rhel-9-rhui-rpms 2>/dev/null || true
      when: ansible_distribution == "RedHat" and ansible_distribution_major_version|int == 9 and rhel9_rhui_check.stdout == "rhui"
      changed_when: false

    # Oracle 8
    - name: Install epel-release on Oracle 8
      ansible.builtin.dnf:
        name: epel-release
        state: present
        disable_gpg_check: true
      when: ansible_distribution == "OracleLinux" and ansible_distribution_major_version|int == 8

    - name: Enable CRB on Oracle 8
      ansible.builtin.command: dnf config-manager --set-enabled ol8_codeready_builder
      when: ansible_distribution == "OracleLinux" and ansible_distribution_major_version|int == 8

    # Oracle 9
    - name: Install epel-release on Oracle 9
      ansible.builtin.dnf:
        name: epel-release
        state: present
        disable_gpg_check: true
      when: ansible_distribution == "OracleLinux" and ansible_distribution_major_version|int == 9

    - name: Enable CRB on Oracle 9
      ansible.builtin.command: dnf config-manager --set-enabled ol9_codeready_builder
      when: ansible_distribution == "OracleLinux" and ansible_distribution_major_version|int == 9

    # Send custom rpm and install it - EL8
    - name: Copy RPM file to remote host on EL8
      ansible.builtin.copy:
        src: /usr/local/nagiosxi/html/config/nmg/ansible/rpms/nagios-mod-gearman-1.0.1-1.el8.x86_64.rpm
        dest: /tmp/nagios-mod-gearman-1.0.1-1.el8.x86_64.rpm
        mode: '0644'
      when: ansible_os_family == "RedHat" and ansible_distribution_major_version|int == 8

    - name: Install custom RPM on EL8
      ansible.builtin.dnf:
        name: /tmp/nagios-mod-gearman-1.0.1-1.el8.x86_64.rpm
        state: present
        update_cache: true
        disable_gpg_check: true
      when: ansible_os_family == "RedHat" and ansible_distribution_major_version|int == 8

    # Send custom rpm and install it - EL9
    - name: Copy RPM file to remote host on EL9
      ansible.builtin.copy:
        src: /usr/local/nagiosxi/html/config/nmg/ansible/rpms/nagios-mod-gearman-1.0.1-1.el9.x86_64.rpm
        dest: /tmp/nagios-mod-gearman-1.0.1-1.el9.x86_64.rpm
        mode: '0644'
      when: ansible_os_family == "RedHat" and ansible_distribution_major_version|int == 9

    - name: Install custom RPM on EL9
      ansible.builtin.dnf:
        name: /tmp/nagios-mod-gearman-1.0.1-1.el9.x86_64.rpm
        state: present
        update_cache: true
        disable_gpg_check: true
      when: ansible_os_family == "RedHat" and ansible_distribution_major_version|int == 9

    # Send plugins and install them - EL8
    - name: Check if plugins RPM exists locally (EL8)
      ansible.builtin.stat:
        path: /usr/local/nagiosxi/html/config/nmg/ansible/plugins/nagios-mod-gearman-plugins-1.0.2-1.el8.x86_64.rpm
      become: false
      delegate_to: localhost
      register: plugins_rpm_file_el8

    - name: Copy plugins RPM file to remote host on EL8
      ansible.builtin.copy:
        src: /usr/local/nagiosxi/html/config/nmg/ansible/plugins/nagios-mod-gearman-plugins-1.0.2-1.el8.x86_64.rpm
        dest: /tmp/nagios-mod-gearman-plugins-1.0.2-1.el8.x86_64.rpm
        mode: '0644'
      when: ansible_os_family == "RedHat" and ansible_distribution_major_version|int == 8

    - name: Install plugins RPM on EL8
      ansible.builtin.dnf:
        name: /tmp/nagios-mod-gearman-plugins-1.0.2-1.el8.x86_64.rpm
        state: present
        update_cache: true
        disable_gpg_check: true
      when: ansible_os_family == "RedHat" and ansible_distribution_major_version|int == 8

    # Send plugins and install them - EL9
    - name: Check if plugins RPM exists locally (EL9)
      ansible.builtin.stat:
        path: /usr/local/nagiosxi/html/config/nmg/ansible/plugins/nagios-mod-gearman-plugins-1.0.2-1.el9.x86_64.rpm
      become: false
      delegate_to: localhost
      register: plugins_rpm_file_el9

    - name: Copy plugins RPM file to remote host on EL9
      ansible.builtin.copy:
        src: /usr/local/nagiosxi/html/config/nmg/ansible/plugins/nagios-mod-gearman-plugins-1.0.2-1.el9.x86_64.rpm
        dest: /tmp/nagios-mod-gearman-plugins-1.0.2-1.el9.x86_64.rpm
        mode: '0644'
      when: ansible_os_family == "RedHat" and ansible_distribution_major_version|int == 9

    - name: Install plugins RPM on EL9
      ansible.builtin.dnf:
        name: /tmp/nagios-mod-gearman-plugins-1.0.2-1.el9.x86_64.rpm
        state: present
        update_cache: true
        disable_gpg_check: true
      when: ansible_os_family == "RedHat" and ansible_distribution_major_version|int == 9

    # Send custom deb and install it - Debian-based (excluding Debian 11)
    - name: Copy DEB file to remote host (Debian-based, non-Debian 11)
      ansible.builtin.copy:
        src: "/usr/local/nagiosxi/html/config/nmg/ansible/debs/{{ item }}"
        dest: "/tmp/{{ item }}"
        mode: '0644'
      loop:
        - nagios-mod-gearman-tools_1.0.1_amd64.deb
        - nagios-mod-gearman-worker_1.0.1_amd64.deb
      when:
        ansible_os_family == "Debian" and not (ansible_distribution == "Debian" and ansible_distribution_major_version == "11")

    - name: Install custom DEB (Debian-based, non-Debian 11)
      become: true
      ansible.builtin.apt:
        deb: "/tmp/{{ item }}"
      loop:
        - nagios-mod-gearman-tools_1.0.1_amd64.deb
        - nagios-mod-gearman-worker_1.0.1_amd64.deb
      when:
        ansible_os_family == "Debian" and not (ansible_distribution == "Debian" and ansible_distribution_major_version == "11")
    
    # Send plugin deb and install it - Ubuntu / Debian
    - name: Copy plugin DEB file to remote host
      ansible.builtin.copy:
        src: "/usr/local/nagiosxi/html/config/nmg/ansible/plugins/nagios-mod-gearman-plugins_1.0.2-1_amd64.deb"
        dest: "/tmp/nagios-mod-gearman-plugins_1.0.2-1_amd64.deb"
        mode: '0644'
      when: ansible_os_family == "Debian"

    - name: Install plugin DEB
      become: true
      ansible.builtin.apt:
        deb: "/tmp/nagios-mod-gearman-plugins_1.0.2-1_amd64.deb"
      when: ansible_os_family == "Debian"

    # Install runtime dependencies for SNMP-based plugins (check_throughput, check_snmp_interface_status)
    - name: Install SNMP plugin runtime deps on EL
      ansible.builtin.dnf:
        name:
          - net-snmp-libs
          - net-snmp-utils
          - sqlite
        state: present
      when: ansible_os_family == "RedHat"

    - name: Install SNMP plugin runtime deps on Debian-based
      ansible.builtin.apt:
        name:
          - snmp
          - libsnmp40
          - sqlite3
          - libsqlite3-0
        state: present
        update_cache: true
      when: ansible_os_family == "Debian"

    - name: Ensure /usr/local/nagios/var directory exists
      ansible.builtin.file:
        path: /usr/local/nagios/var
        state: directory
        owner: nagios
        group: nagios
        mode: '0755'

    - name: Check if throughput database exists locally
      ansible.builtin.stat:
        path: /usr/local/nagios/var/nagios_snmp_throughput.db
      become: false
      delegate_to: localhost
      register: throughput_db_file

    - name: Copy throughput database and reset timestamps for first-run on worker
      when: throughput_db_file.stat.exists
      block:
        - ansible.builtin.copy:
            src: /usr/local/nagios/var/nagios_snmp_throughput.db
            dest: /usr/local/nagios/var/nagios_snmp_throughput.db
            owner: nagios
            group: nagios
            mode: '0644'
        - ansible.builtin.shell: |
            sqlite3 /usr/local/nagios/var/nagios_snmp_throughput.db \
              "SELECT name FROM sqlite_master WHERE type='table';" \
              | xargs -I{} sqlite3 /usr/local/nagios/var/nagios_snmp_throughput.db \
              "UPDATE \"{}\" SET timestamp=0;"

    # Set permissions of every plugin in libexec to nagios:nagios in case the package doesn't
    - name: Set plugin permissions
      ansible.builtin.file:
        path: "/usr/local/nagios/libexec/"
        owner: nagios
        group: nagios
        recurse: true

    # Set SUID for check_dhcp
    - name: Set SUID for check_dhcp
      ansible.builtin.file:
        path: "/usr/local/nagios/libexec/check_dhcp"
        owner: root
        group: nagios
        mode: '4775'

    # Set SUID for check_icmp
    - name: Set SUID for check_icmp
      ansible.builtin.file:
        path: "/usr/local/nagios/libexec/check_icmp"
        owner: root
        group: nagios
        mode: '4775'

    # Enable worker
    - name: Enable worker
      ansible.builtin.systemd:
        name: nagios-mod-gearman-worker
        enabled: true

