---
# Wazuh agent — port of Modules/Security/secharden-wazuh.sh.
# Skipped entirely on the wazuh server itself (legacy TSYS_NSM_CHECK).
# Uses the is_wazuh_server fact set by preflight based on the 'wazuh_server'
# inventory group.

- name: Skip agent install on the Wazuh server
  ansible.builtin.debug:
    msg: "Skipping wazuh-agent install on the wazuh server ({{ inventory_hostname }})."
  when: is_wazuh_server | bool

- name: Install wazuh-agent (non-server hosts)
  when: not (is_wazuh_server | bool)
  block:
    - name: Remove any stale wazuh keyring
      ansible.builtin.file:
        path: /usr/share/keyrings/wazuh.gpg
        state: absent

    - name: Create keyring directory
      ansible.builtin.file:
        path: /usr/share/keyrings
        state: directory
        owner: root
        group: root
        mode: "0755"

    - name: Fetch Wazuh GPG key
      ansible.builtin.get_url:
        url: https://packages.wazuh.com/key/GPG-KEY-WAZUH
        dest: /tmp/GPG-KEY-WAZUH
        mode: "0644"
      changed_when: false

    - name: Import Wazuh GPG key into keyring
      ansible.builtin.command: >-
        gpg --no-default-keyring
        --keyring gnupg-ring:/usr/share/keyrings/wazuh.gpg
        --import /tmp/GPG-KEY-WAZUH
      args:
        creates: /usr/share/keyrings/wazuh.gpg

    - name: Clean up GPG key temp file
      ansible.builtin.file:
        path: /tmp/GPG-KEY-WAZUH
        state: absent

    - name: Set keyring permissions
      ansible.builtin.file:
        path: /usr/share/keyrings/wazuh.gpg
        mode: "0644"
        owner: root
        group: root

    - name: Add Wazuh apt repository
      ansible.builtin.apt_repository:
        repo: "deb [signed-by=/usr/share/keyrings/wazuh.gpg] https://packages.wazuh.com/4.x/apt/ stable main"
        filename: wazuh
        state: present
        update_cache: true

    - name: Install wazuh-agent
      ansible.builtin.apt:
        name: wazuh-agent
        state: present
        update_cache: false
      environment:
        WAZUH_MANAGER: "{{ wazuh_manager }}"

    - name: Hold wazuh-agent package (prevent uncontrolled upgrades)
      ansible.builtin.dpkg_selections:
        name: wazuh-agent
        selection: hold

    - name: Enable and start wazuh-agent
      ansible.builtin.systemd:
        name: wazuh-agent
        enabled: true
        state: started
        daemon_reload: true
      failed_when: false