<commit_before>#
#
# Licensed to the Apache Software Foundation (ASF) under one
# or more contributor license agreements.  See the NOTICE file
# distributed with this work for additional information
# regarding copyright ownership.  The ASF licenses this file
# to you under the Apache License, Version 2.0 (the
# "License"); you may not use this file except in compliance
# with the License.  You may obtain a copy of the License at
#
#   http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing,
# software distributed under the License is distributed on an
# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
# KIND, either express or implied.  See the License for the
# specific language governing permissions and limitations
# under the License.
#

---
- name: Create root directory
  file: path="{{ doc_root_dir }}" state=directory
  become: yes

- include: install_deps_{{ ansible_distribution }}_{{ ansible_distribution_major_version }}.yml

- name: Git clone php gateway
  git:
   repo: "{{ pga_repo }}"
   dest: "{{ doc_root_dir }}"
   version: "{{ git_branch }}"
   update: yes
   force: yes
  become: yes

- name: Create user data dir {{ user_data_dir }}
  file: path="{{ user_data_dir }}" state=directory owner="{{user}}" group="{{group}}" mode=0777 recurse=yes follow=yes
  become: yes

# SELinux configuration
- name: set selinux to enforcing
  selinux: state=enforcing policy=targeted
  become: yes
  when: ansible_os_family == "RedHat"

- name: set selinux context to allow read on public directory
  sefcontext:
    target: "{{ doc_root_dir }}/public(/.*)?"
    setype: httpd_sys_content_t
    state: present
  become: yes
  notify:
    - restart httpd
  when: ansible_os_family == "RedHat"

- name: set selinux context to allow read/write on storage directory
  sefcontext:
    target: "{{ doc_root_dir }}/app/storage(/.*)?"
    setype: httpd_sys_rw_content_t
    state: present
  become: yes
  notify:
    - restart httpd
  when: ansible_os_family == "RedHat"

- name: set selinux context to allow read/write on the user data directory
  sefcontext:
    target: "{{ user_data_dir }}(/.*)?"
    setype: httpd_sys_rw_content_t
    state: present
  become: yes
  notify:
    - restart httpd
  when: ansible_os_family == "RedHat"

- name: allow httpd to connect out to the network
  seboolean:
    name: httpd_can_network_connect
    state: yes
    persistent: yes
  become: yes
  notify:
    - restart httpd
  when: ansible_os_family == "RedHat"

- name: Run composer update
  composer: command=update working_dir="{{ doc_root_dir }}"
  become: yes

# step 6: Change pga configurations
- name: Copy pga config file
  template: src=pga_config.php.j2 dest="{{ doc_root_dir }}/app/config/pga_config.php"
  become: yes

- name: Checkout the portal theme (if a custom theme is defined)
  git:
   repo: "{{ portal_theme_repo }}"
   dest: "{{ doc_root_dir }}/public/themes/{{ portal_theme }}"
   version: "master"
   update: yes
  when: portal_theme != "base"

- name: give read permissions to doc root
  file: path="{{ doc_root_dir }}" state=directory mode=a+rX recurse=yes
  become: yes

- name: give write permissions to storage dir
  file: path="{{ doc_root_dir }}/app/storage" state=directory mode=0777 owner="{{user}}" group="{{group}}" recurse=yes
  become: yes

# For SELinux, need to apply file contexts, but I'm not sure why since the contexts were created before the files/directories
- name: run restorecon on those directories
  command: restorecon -R {{ doc_root_dir }} {{ user_data_dir }}
  become: yes
  when: ansible_os_family == "RedHat"

- name: Enable https and http service on public zone
  firewalld: service="{{ item }}" permanent=true state=enabled zone=public immediate=True
  with_items:
    - http
    - https
  become: yes

- name: copy virtual host config file
  template: src=pga-vhost.conf.j2 dest={{ httpd_confd_file_location[ansible_os_family] }} backup=yes
  become: yes
  notify:
    - restart httpd
  when: not vhost_ssl

- name: copy SSL enabled virtual host config file<commit_msg>Make portal files owned by unprivileged user<commit_after>#
#
# Licensed to the Apache Software Foundation (ASF) under one
# or more contributor license agreements.  See the NOTICE file
# distributed with this work for additional information
# regarding copyright ownership.  The ASF licenses this file
# to you under the Apache License, Version 2.0 (the
# "License"); you may not use this file except in compliance
# with the License.  You may obtain a copy of the License at
#
#   http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing,
# software distributed under the License is distributed on an
# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
# KIND, either express or implied.  See the License for the
# specific language governing permissions and limitations
# under the License.
#

---
- name: Create root directory
  file: path="{{ doc_root_dir }}" state=directory owner="{{user}}" group="{{group}}"
  become: yes

- include: install_deps_{{ ansible_distribution }}_{{ ansible_distribution_major_version }}.yml

- name: Git clone php gateway
  git:
   repo: "{{ pga_repo }}"
   dest: "{{ doc_root_dir }}"
   version: "{{ git_branch }}"
   update: yes
   force: yes
  become: yes
  become_user: "{{user}}"

- name: Create user data dir {{ user_data_dir }}
  file: path="{{ user_data_dir }}" state=directory owner="{{user}}" group="{{group}}" mode=0777 recurse=yes follow=yes
  become: yes

# SELinux configuration
- name: set selinux to enforcing
  selinux: state=enforcing policy=targeted
  become: yes
  when: ansible_os_family == "RedHat"

- name: set selinux context to allow read on public directory
  sefcontext:
    target: "{{ doc_root_dir }}/public(/.*)?"
    setype: httpd_sys_content_t
    state: present
  become: yes
  notify:
    - restart httpd
  when: ansible_os_family == "RedHat"

- name: set selinux context to allow read/write on storage directory
  sefcontext:
    target: "{{ doc_root_dir }}/app/storage(/.*)?"
    setype: httpd_sys_rw_content_t
    state: present
  become: yes
  notify:
    - restart httpd
  when: ansible_os_family == "RedHat"

- name: set selinux context to allow read/write on the user data directory
  sefcontext:
    target: "{{ user_data_dir }}(/.*)?"
    setype: httpd_sys_rw_content_t
    state: present
  become: yes
  notify:
    - restart httpd
  when: ansible_os_family == "RedHat"

- name: allow httpd to connect out to the network
  seboolean:
    name: httpd_can_network_connect
    state: yes
    persistent: yes
  become: yes
  notify:
    - restart httpd
  when: ansible_os_family == "RedHat"

- name: Run composer update
  composer: command=update working_dir="{{ doc_root_dir }}"
  become: yes
  become_user: "{{user}}"

# step 6: Change pga configurations
- name: Copy pga config file
  template: src=pga_config.php.j2 dest="{{ doc_root_dir }}/app/config/pga_config.php" owner="{{user}}" group="{{group}}"
  become: yes

- name: Checkout the portal theme (if a custom theme is defined)
  git:
   repo: "{{ portal_theme_repo }}"
   dest: "{{ doc_root_dir }}/public/themes/{{ portal_theme }}"
   version: "master"
   update: yes
  when: portal_theme != "base"
  become: yes
  become_user: "{{user}}"

- name: give read permissions to doc root
  file: path="{{ doc_root_dir }}" state=directory mode=a+rX owner="{{user}}" group="{{group}}" recurse=yes
  become: yes

- name: give write permissions to storage dir
  file: path="{{ doc_root_dir }}/app/storage" state=directory mode=0777 owner="{{user}}" group="{{group}}" recurse=yes
  become: yes

# For SELinux, need to apply file contexts, but I'm not sure why since the contexts were created before the files/directories
- name: run restorecon on those directories
  command: restorecon -R {{ doc_root_dir }} {{ user_data_dir }}
  become: yes
  when: ansible_os_family == "RedHat"

- name: Enable https and http service on public zone
  firewalld: service="{{ item }}" permanent=true state=enabled zone=public immediate=True
  with_items:
    - http
    - https
  become: yes

- name: copy virtual host config file
  template: src=pga-vhost.conf.j2 dest={{ httpd_confd_file_location[ansible_os_family] }} backup=yes
  become: yes
  notify:
    - restart httpd
  when: not vhost_ssl

- name: copy SSL enabled virtual host config file
{'fraction_non_alphanumeric': 0.1074833174451859, 'fraction_numerical': 0.003574833174451859, 'mean_word_length': 4.046903187011425, 'pattern_counts': {'":': 0, '<': 3, '<?xml version=': 0, '>': 3, 'https://': 0, 'lorem ipsum': 0, 'www.': 2, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '3619276', 'n_tokens_mistral': 2660, 'n_tokens_neox': 2643, 'n_words': 919}