feat: Import code for role

Signed-off-by: Radovan Sroka <rsroka@redhat.com>

tasks/main.yml

@@ -5,23 +5,93 @@
 
 # Examples of some tasks:
 - name: Ensure required packages are installed
-  package:
+  ansible.builtin.package:
     name: "{{ __aide_packages }}"
     state: present
     use: "{{ (__aide_is_ostree | d(false)) |
              ternary('ansible.posix.rhel_rpm_ostree', omit) }}"
+  tags:
+    - never
+    - install
 
 - name: Ensure required services are enabled and started
-  service:
+  ansible.builtin.service:
     name: "{{ item }}"
     state: started
     enabled: true
   loop: "{{ __aide_services }}"
+  tags:
+    - never
 
-- name: Generate /etc/{{ __aide_foo_config }}
-  template:
-    src: "{{ __aide_foo_config }}.j2"
-    dest: /etc/{{ __aide_foo_config }}
+- name: Generate "/etc/{{ __aide_config }}"
+  ansible.builtin.template:
+    src: "{{ __aide_config }}.j2"
+    dest: "/etc/{{ __aide_config }}"
     backup: true
     mode: "0400"
-  notify: Handler for aide to restart services
+  tags:
+    - never
+    - generate_config
+
+- name: Initialize AIDE database and fetch it
+  become: true
+  tags:
+    - never
+    - init
+  block:
+    - name: Initialize AIDE database
+      ansible.builtin.command:
+        cmd: aide --init
+
+    - name: Fetch AIDE database
+      ansible.builtin.fetch:
+        src: "{{ __aide_db_new_name }}"
+        dest: "{{ aide_db_fetch_dir }}"
+
+    - name: Remove remote AIDE database file
+      ansible.builtin.file:
+        path: "{{ __aide_db_new_name }}"
+        state: absent
+
+- name: Check AIDE integrity
+  become: true
+  tags:
+    - never
+    - check
+  block:
+    - name: Copy AIDE reference database to remote
+      ansible.builtin.copy:
+        src:
+          "{{ aide_db_fetch_dir }}/{{ inventory_hostname }}/var/lib/aide/\
+          aide.db.new.gz"
+        dest: "{{ __aide_db_name }}"
+        owner: root
+        group: root
+        mode: "0440"
+
+    - name: Check against AIDE reference database
+      ansible.builtin.command:
+        cmd: aide --check
+      changed_when: false
+
+- name: Update AIDE database and fetch it
+  become: true
+  tags:
+    - never
+    - update
+  block:
+    - name: Update AIDE database
+      ansible.builtin.command:
+        cmd: aide --update
+      register: __aide_update_result
+      failed_when: __aide_update_result.rc > 7
+
+    - name: Fetch AIDE database
+      ansible.builtin.fetch:
+        src: "{{ __aide_db_new_name }}"
+        dest: "{{ aide_db_fetch_dir }}"
+
+    - name: Remove remote AIDE database file
+      ansible.builtin.file:
+        path: "{{ __aide_db_new_name }}"
+        state: absent

tasks/set_vars.yml

@@ -1,12 +1,12 @@
 ---
 - name: Ensure ansible_facts used by role
   setup:
-    gather_subset: "{{ __template_required_facts_subsets }}"
-  when: __template_required_facts |
+    gather_subset: "{{ __aide_required_facts_subsets }}"
+  when: __aide_required_facts |
     difference(ansible_facts.keys() | list) | length > 0
 
 - name: Determine if system is ostree and set flag
-  when: not __template_is_ostree is defined
+  when: not __aide_is_ostree is defined
   block:
     - name: Check if system is ostree
       stat:
@@ -15,7 +15,7 @@
 
     - name: Set flag to indicate system is ostree
       set_fact:
-        __template_is_ostree: "{{ __ostree_booted_stat.stat.exists }}"
+        __aide_is_ostree: "{{ __ostree_booted_stat.stat.exists }}"
 
 - name: Set platform/version specific variables
   include_vars: "{{ __vars_file }}"