---
- name: Install AppArmor packages
  ansible.builtin.package:
    name:
      - apparmor
      - apparmor-utils
      - apparmor-profiles
    state: present
  tags: [apparmor_config]

- name: Enable and start AppArmor
  ansible.builtin.systemd:
    name: apparmor
    enabled: true
    state: started
  tags: [apparmor_config]

- name: Set enforce mode for all loaded profiles
  ansible.builtin.shell: aa-enforce /etc/apparmor.d/*
  register: apparmor_config_enforce_result
  changed_when: "'Setting' in apparmor_config_enforce_result.stdout"
  failed_when: false
  tags: [apparmor_config]

- name: Set application-specific profiles to complain mode (exceptions)
  ansible.builtin.command: "aa-complain {{ item }}"
  loop: "{{ apparmor_config_complain_profiles }}"
  when: apparmor_config_complain_profiles | length > 0
  changed_when: true
  tags: [apparmor_config]

- name: Query AppArmor status
  ansible.builtin.command: aa-status --verbose
  register: apparmor_config_status
  changed_when: false
  failed_when: false
  tags: [apparmor_config]

- name: Report AppArmor status
  ansible.builtin.debug:
    msg: "AppArmor status on {{ inventory_hostname }}: {{ apparmor_config_status.stdout_lines[0] | default('unavailable') }}"
  tags: [apparmor_config]