---
- name: Include OS-family-specific variables
  ansible.builtin.include_vars: "{{ item }}"
  with_first_found:
    - "{{ ansible_facts['os_family'] }}.yml"
    - "default.yml"
  tags: [logging_rsyslog, always]

- name: Install rsyslog with TLS support
  ansible.builtin.package:
    name:
      - rsyslog
      - rsyslog-gnutls
    state: present
  when: syslog_use_tls | bool
  tags: [logging_rsyslog]

- name: Install rsyslog without TLS support
  ansible.builtin.package:
    name: rsyslog
    state: present
  when: not syslog_use_tls | bool
  tags: [logging_rsyslog]

- name: Distribute internal CA certificate for SIEM TLS connection
  ansible.builtin.copy:
    src: "{{ syslog_ca_cert_src }}"
    dest: "{{ logging_rsyslog_ca_cert_dest }}"
    owner: root
    group: root
    mode: "0644"
  when: syslog_ca_cert_enabled | bool
  notify: update CA trust
  tags: [logging_rsyslog]

- name: Deploy forwarding configuration
  ansible.builtin.template:
    src: 60-forward-siem.conf.j2
    dest: /etc/rsyslog.d/60-forward-siem.conf
    owner: root
    group: root
    mode: "0644"
  notify: restart rsyslog
  tags: [logging_rsyslog]

- name: Deploy logrotate configuration
  ansible.builtin.template:
    src: logrotate-cis.j2
    dest: /etc/logrotate.d/rsyslog-cis
    owner: root
    group: root
    mode: "0644"
  tags: [logging_rsyslog]

- name: Enable and start rsyslog
  ansible.builtin.systemd:
    name: rsyslog
    enabled: true
    state: started
  tags: [logging_rsyslog]