---
- name: Include OS-family-specific variables
  ansible.builtin.include_vars: "{{ item }}"
  with_first_found:
    - "{{ ansible_facts['os_family'] }}.yml"
    - "default.yml"
  tags: [falcon_onboarding, always]

- name: Verify a sensor package source is defined
  ansible.builtin.assert:
    that:
      - falcon_onboarding_sensor_package_url | length > 0 or falcon_onboarding_sensor_package_src | length > 0
    fail_msg: >-
      Neither falcon_onboarding_sensor_package_url nor
      falcon_onboarding_sensor_package_src is set. Provide the sensor
      package matching this host's OS (see roles/falcon_onboarding/defaults/main.yml).
  tags: [falcon_onboarding]

- name: Download sensor package from internal URL
  ansible.builtin.get_url:
    url: "{{ falcon_onboarding_sensor_package_url }}"
    dest: "/tmp/falcon-sensor.{{ falcon_onboarding_package_ext }}"
    owner: root
    group: root
    mode: "0644"
  when: falcon_onboarding_sensor_package_url | length > 0
  tags: [falcon_onboarding]

- name: Copy sensor package from the Ansible control node
  ansible.builtin.copy:
    src: "{{ falcon_onboarding_sensor_package_src }}"
    dest: "/tmp/falcon-sensor.{{ falcon_onboarding_package_ext }}"
    owner: root
    group: root
    mode: "0644"
  when: falcon_onboarding_sensor_package_url | length == 0 and falcon_onboarding_sensor_package_src | length > 0
  tags: [falcon_onboarding]

- name: Install Falcon sensor (RedHat family)
  ansible.builtin.dnf:
    name: "/tmp/falcon-sensor.rpm"
    state: present
    disable_gpg_check: false
  when: ansible_facts['os_family'] == "RedHat"
  register: falcon_onboarding_install_result
  tags: [falcon_onboarding]

- name: Install Falcon sensor (Debian family)
  ansible.builtin.apt:
    deb: "/tmp/falcon-sensor.deb"
  when: ansible_facts['os_family'] == "Debian"
  register: falcon_onboarding_install_result
  tags: [falcon_onboarding]

- name: Remove downloaded/copied sensor package
  ansible.builtin.file:
    path: "/tmp/falcon-sensor.{{ falcon_onboarding_package_ext }}"
    state: absent
  tags: [falcon_onboarding]

- name: Configure Customer ID (CID)
  ansible.builtin.command: "/opt/CrowdStrike/falconctl -s --cid={{ falcon_cid }}"
  changed_when: true
  no_log: true
  notify: restart falcon-sensor
  tags: [falcon_onboarding]

- name: Configure provisioning token if required
  ansible.builtin.command: "/opt/CrowdStrike/falconctl -s --provisioning-token={{ falcon_onboarding_provisioning_token }}"
  changed_when: true
  no_log: true
  when: falcon_onboarding_provisioning_token | length > 0
  notify: restart falcon-sensor
  tags: [falcon_onboarding]

- name: Enable and start the Falcon sensor service
  ansible.builtin.systemd:
    name: falcon-sensor
    enabled: true
    state: started
  tags: [falcon_onboarding]

- name: Check reduced-functionality mode (RFM)
  ansible.builtin.command: /opt/CrowdStrike/falconctl -g --rfm-state
  register: falcon_onboarding_rfm_state
  changed_when: false
  failed_when: false
  tags: [falcon_onboarding]

- name: Query agent ID (AID) for verification
  ansible.builtin.command: /opt/CrowdStrike/falconctl -g --aid
  register: falcon_onboarding_aid
  changed_when: false
  failed_when: false
  tags: [falcon_onboarding]

- name: Report Falcon onboarding status
  ansible.builtin.debug:
    msg: "CrowdStrike Falcon on {{ inventory_hostname }} - {{ falcon_onboarding_rfm_state.stdout }} | {{ falcon_onboarding_aid.stdout }}"
  tags: [falcon_onboarding]