---
- name: Fetch OS dependent variables
  ansible.builtin.include_vars:
    file: "{{ item }}"
    name: os_vars
  with_first_found:
    - files:
        - "{{ ansible_facts.distribution }}_{{ ansible_facts.distribution_major_version }}.yml"
        - "{{ ansible_facts.distribution }}.yml"
        - "{{ ansible_facts.os_family }}_{{ ansible_facts.distribution_major_version }}.yml"
        - "{{ ansible_facts.os_family }}.yml"
      skip: true
  tags: always

# we only override variables with our default if they have not been specified already.
# by default the lookup functions finds all varnames containing the string, therefore
# we add ^ and $ to denote start and end of string, so this returns only exact matches.
- name: Set OS dependent variables, if not already defined by user # noqa var-naming
  ansible.builtin.set_fact:
    "{{ item.key }}": "{{ item.value }}"
  when: not lookup('varnames', '^' + item.key + '$')
  with_dict: "{{ os_vars }}"
  tags: always

- name: Check that the variable mysql_distribution is set correctly
  ansible.builtin.assert:
    that: mysql_distribution == 'mysql' or mysql_distribution == 'mariadb'
    fail_msg: mysql_distribution must be set to either mysql or mariadb!
  when: mysql_distribution is defined

- name: Gather package facts to check for mysql/mariadb version
  ansible.builtin.package_facts:
    manager: auto
  when: not mysql_distribution is defined

- name: Check if MySQL or MariaDB is used
  ansible.builtin.set_fact:
    mysql_distribution: "{{ ansible_facts.packages['mysql-server'] is defined | ternary('mysql', 'mariadb') }}"
  when: not mysql_distribution is defined

- name: Check which MySQL/MariaDB version is used
  community.mysql.mysql_info:
    filter: version
    login_unix_socket: "{{ login_unix_socket | default(omit) }}"
  register: mysql_version

- name: Check MySQL/MariaDB settings
  community.mysql.mysql_info:
    filter: settings
    login_unix_socket: "{{ login_unix_socket | default(omit) }}"
  register: mysql_settings

# see https://stackoverflow.com/a/59451077/2953919 for the
# dict2items and vice versa magic
- name: Drop the secure-auth parameter on MySQL >=8.0.3 (not mariadb)
  ansible.builtin.set_fact:
    mysql_hardening_options: "{{ mysql_hardening_options | dict2items | rejectattr('key', 'search', 'secure-auth') | list | items2dict }}"
  when:
    - mysql_version.version.full is version('8.0.3', '>=')
    - mysql_distribution == "mysql"

- name: Include tasks for configuration
  ansible.builtin.import_tasks: configure.yml
  when: mysql_hardening_enabled | bool
  tags:
    - mysql_hardening

- name: Include tasks to secure mysql installation
  ansible.builtin.import_tasks: mysql_secure_installation.yml
  when: mysql_hardening_enabled | bool
  tags:
    - mysql_hardening
    - mysql_secure_installation