---
# Multi-OS LEMP WordPress installation with auto-detection
- name: Install LEMP stack with WordPress (Multi-OS Support)
  hosts: all
  become: yes

  pre_tasks:
    - name: Gather OS facts
      setup:
        gather_subset:
          - '!all'
          - '!min'
          - 'distribution'
          - 'distribution_version'
          - 'os_family'

    - name: Load OS-specific variables
      include_vars: "../vars/{{ ansible_os_family | lower }}.yml"

    - name: Debug OS information
      debug:
        msg: |
          OS Family: {{ ansible_os_family }}
          Distribution: {{ ansible_distribution }}
          Version: {{ ansible_distribution_version }}
          Using variables from: vars/{{ ansible_os_family | lower }}.yml

  vars:
    # WordPress Configuration
    wordpress_path: "{{ web_root }}"
    wordpress_url: "http://{{ ansible_default_ipv4.address | default('localhost') }}"

    # Database Configuration
    mysql_root_password: "{{ mysql_root_password | default('secure_root_password_' + ansible_date_time.epoch) }}"
    wordpress_db_name: "{{ wordpress_db_name | default('wordpress_db') }}"
    wordpress_db_user: "{{ wordpress_db_user | default('wordpress_user') }}"
    wordpress_db_password: "{{ wordpress_db_password | default('secure_wp_password_' + ansible_date_time.epoch) }}"

    # WordPress Admin
    wp_admin_user: "{{ wp_admin_user | default('admin') }}"
    wp_admin_password: "{{ wp_admin_password | default('secure_admin_password_' + ansible_date_time.epoch) }}"
    wp_admin_email: "{{ wp_admin_email | default('admin@localhost') }}"
    wp_site_title: "{{ wp_site_title | default('My WordPress Site') }}"

  tasks:
    # Repository Setup for RedHat family
    - name: Enable EPEL repository (RedHat/CentOS)
      package:
        name: "{{ epel_release }}"
        state: present
      when: ansible_os_family == "RedHat"
      tags: repos

    - name: Install Remi repository (RedHat/CentOS)
      yum:
        name: "{{ remi_release }}"
        state: present
      when: ansible_os_family == "RedHat"
      tags: repos

    - name: Enable Remi PHP repository (RedHat/CentOS)
      command: "yum-config-manager --enable remi-php{{ php_version | replace('.', '') }}"
      when: ansible_os_family == "RedHat"
      tags: repos

    # Package Installation
    - name: Update package cache (Debian/Ubuntu)
      apt:
        update_cache: yes
        cache_valid_time: 3600
      when: ansible_os_family == "Debian"
      tags: packages

    - name: Install Nginx
      package:
        name: "{{ nginx_package }}"
        state: present
      tags: nginx

    - name: Install MySQL/MariaDB packages
      package:
        name: "{{ mysql_packages }}"
        state: present
      tags: mysql

    - name: Install PHP packages
      package:
        name: "{{ php_packages }}"
        state: present
      tags: php

    - name: Install additional tools (Debian/Ubuntu)
      package:
        name:
          - curl
          - wget
          - unzip
          - git
        state: present
      when: ansible_os_family == "Debian"
      tags: tools

    - name: Install additional tools (RedHat/CentOS)
      yum:
        name:
          - curl
          - wget
          - unzip
          - git
        state: present
        allowerasing: yes
      when: ansible_os_family == "RedHat"
      tags: tools

    # Service Management
    - name: Start and enable Nginx
      service:
        name: "{{ nginx_service }}"
        state: started
        enabled: yes
      tags: nginx

    - name: Start and enable MySQL/MariaDB
      service:
        name: "{{ mysql_service }}"
        state: started
        enabled: yes
      tags: mysql

    - name: Start and enable PHP-FPM
      service:
        name: "{{ php_fpm_service }}"
        state: started
        enabled: yes
      tags: php

    # SELinux Configuration (RedHat family)
    - name: Configure SELinux booleans for web services
      seboolean:
        name: "{{ item }}"
        state: yes
        persistent: yes
      loop: "{{ selinux_booleans }}"
      when: ansible_os_family == "RedHat" and ansible_selinux.status == "enabled"
      tags: selinux

    # Firewall Configuration
    - name: Configure firewall (UFW - Debian/Ubuntu)
      ufw:
        rule: allow
        port: "{{ item }}"
        proto: tcp
      loop:
        - "22"
        - "80"
        - "443"
      when: ansible_os_family == "Debian"
      tags: firewall

    - name: Configure firewall (firewalld - RedHat/CentOS)
      firewalld:
        service: "{{ item }}"
        permanent: yes
        state: enabled
        immediate: yes
      loop:
        - ssh
        - http
        - https
      when: ansible_os_family == "RedHat"
      tags: firewall

    # MySQL Security
    - name: Set MySQL root password
      mysql_user:
        name: root
        password: "{{ mysql_root_password }}"
        login_unix_socket: "{{ mysql_socket }}"
        state: present
      tags: mysql

    - name: Create MySQL configuration for root
      template:
        src: ../templates/my.cnf.j2
        dest: /root/.my.cnf
        mode: '0600'
      tags: mysql

    - name: Remove anonymous MySQL users
      mysql_user:
        name: ""
        host_all: yes
        state: absent
      tags: mysql

    - name: Remove MySQL test database
      mysql_db:
        name: test
        state: absent
      tags: mysql

    # WordPress Database Setup
    - name: Create WordPress database
      mysql_db:
        name: "{{ wordpress_db_name }}"
        state: present
      tags: mysql

    - name: Create WordPress database user
      mysql_user:
        name: "{{ wordpress_db_user }}"
        password: "{{ wordpress_db_password }}"
        priv: "{{ wordpress_db_name }}.*:ALL"
        host: localhost
        state: present
      tags: mysql

    # WordPress Installation
    - name: Create web root directory
      file:
        path: "{{ wordpress_path }}"
        state: directory
        owner: "{{ nginx_user }}"
        group: "{{ nginx_user }}"
        mode: '0755'
      tags: wordpress

    - name: Download WordPress
      get_url:
        url: https://wordpress.org/latest.tar.gz
        dest: /tmp/wordpress.tar.gz
        mode: '0644'
      tags: wordpress

    - name: Extract WordPress
      unarchive:
        src: /tmp/wordpress.tar.gz
        dest: /tmp/
        remote_src: yes
      tags: wordpress

    - name: Copy WordPress files
      command: "cp -r /tmp/wordpress/* {{ wordpress_path }}/"
      args:
        creates: "{{ wordpress_path }}/wp-config-sample.php"
      tags: wordpress

    - name: Set WordPress file permissions
      file:
        path: "{{ wordpress_path }}"
        owner: "{{ nginx_user }}"
        group: "{{ nginx_user }}"
        recurse: yes
      tags: wordpress

    # Nginx Configuration
    - name: Configure Nginx for WordPress (Debian/Ubuntu)
      template:
        src: ../templates/wordpress.nginx.j2
        dest: "{{ nginx_sites_available }}/wordpress"
      when: ansible_os_family == "Debian"
      notify: restart nginx
      tags: nginx

    - name: Configure Nginx for WordPress (RedHat/CentOS)
      template:
        src: ../templates/wordpress-redhat.nginx.j2
        dest: "{{ nginx_sites_available }}/wordpress.conf"
      when: ansible_os_family == "RedHat"
      notify: restart nginx
      tags: nginx

    - name: Enable WordPress site (Debian/Ubuntu)
      file:
        src: "{{ nginx_sites_available }}/wordpress"
        dest: "{{ nginx_sites_enabled }}/wordpress"
        state: link
      when: ansible_os_family == "Debian"
      notify: restart nginx
      tags: nginx

    - name: Remove default Nginx site (Debian/Ubuntu)
      file:
        path: "{{ nginx_sites_enabled }}/default"
        state: absent
      when: ansible_os_family == "Debian"
      notify: restart nginx
      tags: nginx

    # PHP Configuration
    - name: Configure PHP-FPM pool
      template:
        src: ../templates/www.conf.j2
        dest: "{{ php_fpm_pool_dir }}/www.conf"
        backup: yes
      notify: restart php-fpm
      tags: php

    - name: Configure PHP settings
      lineinfile:
        path: "{{ php_ini_path }}"
        regexp: "{{ item.regexp }}"
        line: "{{ item.line }}"
        backup: yes
      loop:
        - { regexp: '^upload_max_filesize', line: 'upload_max_filesize = 64M' }
        - { regexp: '^post_max_size', line: 'post_max_size = 64M' }
        - { regexp: '^memory_limit', line: 'memory_limit = 256M' }
        - { regexp: '^max_execution_time', line: 'max_execution_time = 300' }
      notify: restart php-fpm
      tags: php

    # WordPress Configuration
    - name: Configure WordPress
      template:
        src: ../templates/wp-config.php.j2
        dest: "{{ wordpress_path }}/wp-config.php"
        owner: "{{ nginx_user }}"
        group: "{{ nginx_user }}"
        mode: '0600'
      tags: wordpress

    # WP-CLI Installation
    - name: Download WP-CLI
      get_url:
        url: https://raw.githubusercontent.com/wp-cli/builds/gh-pages/phar/wp-cli.phar
        dest: /usr/local/bin/wp
        mode: '0755'
      tags: wp-cli

    - name: Verify WP-CLI installation
      command: wp --info
      become_user: "{{ nginx_user }}"
      environment:
        HOME: "{{ wordpress_path }}"
      register: wp_cli_info
      tags: wp-cli

    - name: Display WP-CLI info
      debug:
        var: wp_cli_info.stdout_lines
      tags: wp-cli

  handlers:
    - name: restart nginx
      service:
        name: "{{ nginx_service }}"
        state: restarted

    - name: restart php-fpm
      service:
        name: "{{ php_fpm_service }}"
        state: restarted

    - name: restart mysql
      service:
        name: "{{ mysql_service }}"
        state: restarted