---
- name: converge
  hosts: all
  become: yes
  gather_facts: yes

  vars:
    tomcat_address: 127.0.0.1
    tomcat_instances:
      - name: "tomcat"
      - name: "tomcat-version-7"
        version: 7
        shutdown_port: 8007
        non_ssl_connector_port: 8082
        ssl_connector_port: 8445
        ajp_port: 8011
      - name: "tomcat-version-8"
        version: 8
        shutdown_port: 8008
        non_ssl_connector_port: 8083
        ssl_connector_port: 8446
        ajp_port: 8012
      - name: "tomcat-version-9"
        version: 9
        shutdown_port: 8019
        non_ssl_connector_port: 8084
        ssl_connector_port: 8447
        ajp_port: 8013
      - name: "tomcat-specific"
        user: "specificuser"
        group: "specificgroup"
        shutdown_port: 8020
        non_ssl_connector_port: 8085
        ssl_connector_port: 8448
        ajp_port: 8014
        xms: 256M
        xmx: 512M
      - name: "tomcat-with-wars"
        shutdown_port: 8021
        non_ssl_connector_port: 8086
        ssl_connector_port: 8449
        ajp_port: 8015
        wars:
          - url: https://tomcat.apache.org/tomcat-7.0-doc/appdev/sample/sample.war
          - url: "https://github.com/aeimer/java-example-helloworld-war/raw/master/dist/helloworld.war"
      - name: "tomcat-java_opts"
        shutdown_port: 8022
        non_ssl_connector_port: 8087
        ssl_connector_port: 8449
        ajp_port: 8016
        java_opts:
          - name: UMASK
            value: "0007"
      - name: "tomcat-with_lib"
        shutdown_port: 8023
        non_ssl_connector_port: 8088
        ssl_connector_port: 8450
        ajp_port: 8017
        libs:
          - url: "https://search.maven.org/remotecontent?filepath=io/prometheus/simpleclient/0.6.0/simpleclient-0.6.0.jar"

  roles:
    - role: robertdebock.tomcat

---
- name: prepare
  hosts: all
  become: yes
  gather_facts: no

  roles:
    - role: robertdebock.bootstrap
    - role: robertdebock.core_dependencies
    - role: robertdebock.java

---
- name: Verify
  hosts: all
  become: yes
  gather_facts: yes

  vars:
    _netcat_package:
      default: nc
      Alpine: netcat-openbsd
      Debian: netcat
      Suse: netcat-openbsd
    netcat_package: "{{ _netcat_package[ansible_os_family] | default(_netcat_package['default']) }}"

  tasks:
    - name: install netcat
      package:
        name: "{{ netcat_package }}"

    - name: let netcat listen on port 127.0.0.2:8080
      shell: nc --listen --keep-open 127.0.0.2 8080 &

    - name: see if sensitive information is not exposed
      uri:
        url: "http://localhost:8080/"
        return_content: yes
      register: this
      failed_when:
        - "'successfully installed Tomcat' in this.content"

---
# defaults file for tomcat

# The explicit version to use when referring to the short name.
tomcat_version7: 7.0.104
tomcat_version8: 8.5.56
tomcat_version9: 9.0.36

# The location where to download Apache Tomcat from.
tomcat_mirror: "https://archive.apache.org"

# Some "sane" defaults.
tomcat_name: tomcat
tomcat_directory: /opt
tomcat_version: 8
tomcat_user: tomcat
tomcat_group: tomcat
tomcat_xms: 512M
tomcat_xmx: 1024M
tomcat_non_ssl_connector_port: 8080
tomcat_ssl_connector_port: 8443
tomcat_shutdown_port: 8005
tomcat_ajp_port: 8009
tomcat_jre_home: /usr
# You can bind Tomcat to a specified address globally using this variable, or
# in the `tomcat_instances`. The `tomcat_instances.address` is more specific
# so it takes priority over `tomcat_address`.
tomcat_address: 0.0.0.0

# This role allows multiple installations of Apache Tomcat, each in their own
# location, potentially of different version.
# This is done by defining a "tomcat_instances" where "name:" is a unique
# identifier of an instance.
# The default tomcat_instances is one instance using the defaults described
# in defaults/main.yml.
tomcat_instances:
  - name: "{{ tomcat_name }}"
    version: "{{ tomcat_version }}"
    user: "{{ tomcat_user }}"
    group: "{{ tomcat_group }}"
    xms: "{{ tomcat_xms }}"
    xmx: "{{ tomcat_xmx }}"
    non_ssl_connector_port: "{{ tomcat_non_ssl_connector_port }}"
    ssl_connector_port: "{{ tomcat_ssl_connector_port }}"
    shutdown_port: "{{ tomcat_shutdown_port }}"
    ajp_port: "{{ tomcat_ajp_port }}"
    # You can pick an address per instance:
    # address: 127.0.0.1
    java_opts:
      - name: JRE_HOME
        value: "{{ tomcat_jre_home }}"

# When downloading wars, should the SSL certificate be valid? (Impossible for
# CentOS 6, so default: no.)
tomcat_validate_certs: no

---
- robertdebock.bootstrap
- robertdebock.core_dependencies
- robertdebock.java
- robertdebock.service