---
- name: Include OS-family-specific variables
  ansible.builtin.include_vars: "{{ item }}"
  with_first_found:
    - "{{ ansible_facts['os_family'] }}.yml"
    - "default.yml"
  tags: [aide_integrity, always]

- name: Install AIDE
  ansible.builtin.package:
    name: aide
    state: present
  tags: [aide_integrity]

- name: Deploy custom AIDE configuration (additional watched paths)
  ansible.builtin.template:
    src: aide-custom.conf.j2
    dest: "{{ aide_integrity_config_dest }}"
    owner: root
    group: root
    mode: "0640"
  tags: [aide_integrity]

- name: Check whether an AIDE database already exists
  ansible.builtin.stat:
    path: "{{ aide_integrity_db_path }}"
  register: aide_integrity_db_stat
  tags: [aide_integrity]

- name: Initialize AIDE database (first run only)
  ansible.builtin.command: aide --init
  when: not aide_integrity_db_stat.stat.exists
  changed_when: true
  tags: [aide_integrity]

- name: Activate the initial AIDE database
  ansible.builtin.command: "mv {{ aide_integrity_db_new_path }} {{ aide_integrity_db_path }}"
  when: not aide_integrity_db_stat.stat.exists
  changed_when: true
  tags: [aide_integrity]

- name: Schedule regular AIDE check via cron
  ansible.builtin.cron:
    name: "Daily AIDE integrity check"
    hour: "{{ aide_check_cron_hour }}"
    minute: "{{ aide_check_cron_minute }}"
    job: >-
      {{ aide_integrity_check_cmd }} | /usr/bin/mail -s
      "AIDE integrity report {{ inventory_hostname }}" {{ aide_notify_email }}
    user: root
  tags: [aide_integrity]

- name: Note on updating the database after legitimate changes
  ansible.builtin.debug:
    msg: >-
      After intended system changes (patches, config changes made outside
      Ansible), update the AIDE database manually:
      aide --update && mv {{ aide_integrity_db_new_path }} {{ aide_integrity_db_path }}
  tags: [aide_integrity]