- name: Add mox group
  ansible.builtin.group:
    name: mox

- name: Add mox user
  ansible.builtin.user:
    name: mox
    group: mox
    groups:
      - tls
    append: false

- name: Create mox configuration directory
  register: mox_conf_dir
  ansible.builtin.file:
    path: ~mox/config/
    owner: mox

- name: Create DKIM private keys directory
  register: mox_dkim_dir
  ansible.builtin.file:
    path: ~mox/config/dkim

- name: Install DKIM private key A
  register: mox_dkim_a
  ansible.builtin.copy:
    src: dkim/2026a._domainkey.mail.joeac.net.20260705T163220.rsa2048.privatekey.pkcs8.pem
    dest: ~mox/config/dkim/2026a._domainkey.mail.joeac.net.20260705T163220.rsa2048.privatekey.pkcs8.pem
    mode: o-rwx

- name: Install DKIM private key B
  register: mox_dkim_b
  ansible.builtin.copy:
    src: dkim/2026b._domainkey.mail.joeac.net.20260705T163220.rsa2048.privatekey.pkcs8.pem
    dest: ~mox/config/dkim/2026b._domainkey.mail.joeac.net.20260705T163220.rsa2048.privatekey.pkcs8.pem
    mode: o-rwx

- name: Install adminpasswd
  register: mox_adminpasswd
  ansible.builtin.copy:
    src: adminpasswd
    dest: ~mox/config/adminpasswd
    mode: o-rwx

- name: Install mox configuration
  register: mox_conf
  ansible.builtin.template:
    src: mox.conf
    dest: ~mox/config/mox.conf
    mode: o-rwx

- name: Install mox domain configuration
  register: mox_domain_conf
  ansible.builtin.template:
    src: domains.conf
    dest: ~mox/config/domains.conf
    mode: o-rwx

- name: Create mox data directory
  ansible.builtin.file:
    path: ~mox/data
    state: directory
    mode: o-rwx

- name: Create unbound configuration directory
  ansible.builtin.file:
    path: /etc/unbound/unbound.conf.d
    state: directory
    mode: "444"

- name: Install DNSSEC configuration
  register: dnssec_conf
  ansible.builtin.template:
    src: dnssec.conf
    dest: /etc/unbound/unbound.conf.d/dnssec.conf

- name: Install unbound binary
  community.general.apk:
    name: unbound
    state: present

- name: Restart unbound service and configure to start on boot
  when: dnssec_conf is changed
  ansible.builtin.service:
    name: unbound
    enabled: true
    state: restarted

- name: Start unbound service and configure to start on boot
  when: not ( dnssec_conf is changed )
  ansible.builtin.service:
    name: unbound
    enabled: true
    state: started

- name: Configure networking to point at unbound DNS resolver
  ansible.builtin.copy:
    content: "nameserver: 127.0.0.1"
    dest: /etc/resolv.conf
    backup: true
    mode: "444"

- name: Install mox binary
  register: mox_binary
  ansible.builtin.get_url:
    dest: /usr/bin/mox
    mode: "755"
    url: https://beta.gobuilds.org/github.com/mjl-/mox@latest/linux-{{ mox_platform }}-latest/dl

- name: Install mox service
  register: mox_service
  ansible.builtin.template:
    src: openrc/mox
    dest: /etc/init.d/mox
    mode: "755"

- name: Restart mox service and configure to start on boot
  when:
    mox_conf_dir is changed
      or mox_dkim_dir is change
      or mox_dkim_a is change
      or mox_dkim_b is change
      or mox_adminpasswd is change
      or mox_conf is change
      or mox_domain_conf is changed
      or mox_binary is changed
      or mox_service is changed
  ansible.builtin.service:
    name: mox
    enabled: true
    state: restarted

- name: Start mox service and configure to start on boot
  when: not (
    mox_conf_dir is changed
      or mox_dkim_dir is change
      or mox_dkim_a is change
      or mox_dkim_b is change
      or mox_adminpasswd is change
      or mox_conf is change
      or mox_domain_conf is changed
      or mox_binary is changed
      or mox_service is changed )
  ansible.builtin.service:
    name: mox
    enabled: true
    state: started

- name: Set account passwords
  loop: "{{ email_accounts }}"
  no_log: true
  ansible.builtin.command:
    cmd: mox setaccountpassword {{ item.name }}
    stdin: "{{ item.password }}"
    chdir: ~mox

- name: Install script to update mox
  ansible.builtin.template:
    src: update_mox
    dest: /usr/bin/update_mox
    mode: "755"

- name: Install daily crontab to update mox
  ansible.builtin.cron:
    special_time: daily
    name: Update mox
    job: /usr/bin/update_mox