- name: Install Kerberos server
  ansible.builtin.apt:
    pkg:
      - krb5-user
      - krb5-kdc
      - krb5-admin-server
    state: present
    update_cache: yes

- name: Enables krb5-kdc
  ansible.builtin.service:
    name: krb5-kdc
    enabled: true

- name: Enables krb5-admin-server
  ansible.builtin.service:
    name: krb5-admin-server
    enabled: true

- name: Configure krb5
  ansible.builtin.template:
    src: krb5.conf.j2
    dest: /etc/krb5.conf
    owner: root
    group: root
    mode: "0644"
  notify:
    - Restart krb5 kdc
    - Restart krb5 admin server

- name: Configure krb5 kdc
  ansible.builtin.template:
    src: kdc.conf.j2
    dest: /etc/krb5kdc/kdc.conf
    owner: root
    group: root
    mode: "0644"
  notify:
    - Restart krb5 kdc
    - Restart krb5 admin server

- name: Configure krb5 ACLs
  # Allow */admin (notable root/admin) user to manage principals
  ansible.builtin.template:
    src: kadm5.acl.j2
    dest: /etc/krb5kdc/kadm5.acl
    owner: root
    group: root
    mode: "0644"
  notify:
    - Restart krb5 kdc
    - Restart krb5 admin server


- name: Create kdc
  ansible.builtin.command:
    cmd: "kdb5_util create -P {{ krb5_master_password }}"
  register: create_kdc
  failed_when: create_kdc.rc != 0 and create_kdc.rc != 1
  changed_when: create_kdc.rc == 0

- name: Create kdc stash file
  # The stash file is specified in kdc.conf as key_stash_file
  ansible.builtin.command:
    cmd: "kdb5_util stash -P {{ krb5_master_password }}"

- name: Start krb5-kdc
  ansible.builtin.service:
    name: krb5-kdc
    state: started

- name: Start krb5-admin-server
  ansible.builtin.service:
    name: krb5-admin-server
    state: started