infra/ansible/roles/freeradius/tasks/main.yml

---
- name: Install FreeRADIUS and MySQL packages
  ansible.builtin.apt:
    name: "{{ freeradius_packages }}"
    state: present
  notify: restart freeradius

- name: Set MariaDB to listen on all interfaces
  ansible.builtin.lineinfile:
    path: /etc/mysql/mariadb.conf.d/50-server.cnf
    regexp: '^bind-address'
    line: 'bind-address = 0.0.0.0'
  notify: restart mariadb

- name: Deploy MariaDB tuning config
  ansible.builtin.template:
    src: mariadb-tuning.cnf.j2
    dest: /etc/mysql/mariadb.conf.d/99-freeradius-tuning.cnf
    owner: root
    group: root
    mode: '0644'
  notify: restart mariadb

- name: Create radius database
  ansible.mysql.mysql_db:
    name: "{{ freeradius_db_name }}"
    state: present
    login_unix_socket: /run/mysqld/mysqld.sock
  when: freeradius_seed_db | bool

- name: Create radius database user
  ansible.mysql.mysql_user:
    name: "{{ freeradius_db_user }}"
    password: "{{ vault_freeradius_db_password }}"
    priv: "{{ freeradius_db_name }}.*:SELECT,INSERT,UPDATE,DELETE"
    host: localhost
    state: present
    login_unix_socket: /run/mysqld/mysqld.sock
  when: freeradius_seed_db | bool

- name: Copy schema SQL to server
  ansible.builtin.copy:
    src: schema.sql
    dest: /tmp/radius-schema.sql
    owner: root
    group: root
    mode: '0640'
  when: freeradius_seed_db | bool

- name: Seed radius database schema
  ansible.mysql.mysql_db:
    name: "{{ freeradius_db_name }}"
    state: import
    target: /tmp/radius-schema.sql
    login_unix_socket: /run/mysqld/mysqld.sock
  when: freeradius_seed_db | bool

- name: Clean up schema SQL
  ansible.builtin.file:
    path: /tmp/radius-schema.sql
    state: absent
  when: freeradius_seed_db | bool

- name: Ensure freeradius config directory exists
  ansible.builtin.file:
    path: "{{ freeradius_config_dir }}"
    state: directory
    owner: root
    group: freerad
    mode: '0750'

- name: Ensure mods-enabled directory exists
  ansible.builtin.file:
    path: "{{ freeradius_config_dir }}/mods-enabled"
    state: directory
    owner: root
    group: freerad
    mode: '0750'

- name: Ensure sites-enabled directory exists
  ansible.builtin.file:
    path: "{{ freeradius_config_dir }}/sites-enabled"
    state: directory
    owner: root
    group: freerad
    mode: '0750'

- name: Ensure sql config directories exist
  ansible.builtin.file:
    path: "{{ freeradius_config_dir }}/mods-config/sql/main/{{ freeradius_sql_dialect }}"
    state: directory
    owner: root
    group: freerad
    mode: '0750'

- name: Deploy radiusd.conf
  ansible.builtin.template:
    src: radiusd.conf.j2
    dest: "{{ freeradius_config_dir }}/radiusd.conf"
    owner: root
    group: freerad
    mode: '0640'
  notify: restart freeradius

- name: Deploy clients.conf
  ansible.builtin.template:
    src: clients.conf.j2
    dest: "{{ freeradius_config_dir }}/clients.conf"
    owner: root
    group: freerad
    mode: '0640'
  notify: restart freeradius

- name: Deploy SQL module config
  ansible.builtin.template:
    src: sql.j2
    dest: "{{ freeradius_config_dir }}/mods-available/sql"
    owner: root
    group: freerad
    mode: '0640'
  notify: restart freeradius

- name: Deploy SQL queries.conf
  ansible.builtin.copy:
    src: queries.conf
    dest: "{{ freeradius_config_dir }}/mods-config/sql/main/{{ freeradius_sql_dialect }}/queries.conf"
    owner: root
    group: freerad
    mode: '0640'
  notify: restart freeradius

- name: Deploy cache module config
  ansible.builtin.template:
    src: cache.j2
    dest: "{{ freeradius_config_dir }}/mods-available/cache"
    owner: root
    group: freerad
    mode: '0640'
  notify: restart freeradius

- name: Deploy default virtual server
  ansible.builtin.template:
    src: default.j2
    dest: "{{ freeradius_config_dir }}/sites-available/default"
    owner: root
    group: freerad
    mode: '0640'
  notify: restart freeradius

- name: Deploy inner-tunnel virtual server
  ansible.builtin.template:
    src: inner-tunnel.j2
    dest: "{{ freeradius_config_dir }}/sites-available/inner-tunnel"
    owner: root
    group: freerad
    mode: '0640'
  notify: restart freeradius

- name: Deploy CoA virtual server
  ansible.builtin.template:
    src: coa.j2
    dest: "{{ freeradius_config_dir }}/sites-available/coa"
    owner: root
    group: freerad
    mode: '0640'
  notify: restart freeradius

- name: Deploy proxy.conf
  ansible.builtin.template:
    src: proxy.conf.j2
    dest: "{{ freeradius_config_dir }}/proxy.conf"
    owner: root
    group: freerad
    mode: '0640'
  notify: restart freeradius

- name: Enable SQL module
  ansible.builtin.file:
    src: "{{ freeradius_config_dir }}/mods-available/sql"
    dest: "{{ freeradius_config_dir }}/mods-enabled/sql"
    state: link
    force: true
    owner: root
    group: freerad
  notify: restart freeradius

- name: Enable cache module
  ansible.builtin.file:
    src: "{{ freeradius_config_dir }}/mods-available/cache"
    dest: "{{ freeradius_config_dir }}/mods-enabled/cache"
    state: link
    force: true
    owner: root
    group: freerad
  notify: restart freeradius

- name: Enable default site
  ansible.builtin.file:
    src: "{{ freeradius_config_dir }}/sites-available/default"
    dest: "{{ freeradius_config_dir }}/sites-enabled/default"
    state: link
    force: true
    owner: root
    group: freerad
  notify: restart freeradius

- name: Enable CoA site
  ansible.builtin.file:
    src: "{{ freeradius_config_dir }}/sites-available/coa"
    dest: "{{ freeradius_config_dir }}/sites-enabled/coa"
    state: link
    force: true
    owner: root
    group: freerad
  notify: restart freeradius

- name: Seed NAS clients from ansible vars
  ansible.mysql.mysql_query:
    login_db: "{{ freeradius_db_name }}"
    login_unix_socket: /run/mysqld/mysqld.sock
    query: >-
      INSERT INTO nas (nasname, shortname, type, ports, secret, server, community, description)
      VALUES ('{{ item.nasname }}', '{{ item.shortname }}', '{{ item.type | default('other') }}',
              {{ item.ports | default(0) }}, '{{ item.secret }}',
              {{ ("'" + item.server + "'") if item.server is defined and item.server else 'NULL' }},
              {{ ("'" + item.community + "'") if item.community is defined and item.community else 'NULL' }},
              {{ ("'" + item.description + "'") if item.description is defined and item.description else 'NULL' }})
      ON DUPLICATE KEY UPDATE
        shortname = VALUES(shortname), type = VALUES(type),
        secret = VALUES(secret), server = VALUES(server),
        community = VALUES(community), description = VALUES(description)
  loop: "{{ freeradius_nas_clients }}"
  when: freeradius_seed_nas | bool and freeradius_nas_clients | length > 0

- name: Copy user data SQL to server
  ansible.builtin.copy:
    src: seed-data.sql
    dest: /tmp/radius-seed-data.sql
    owner: root
    group: root
    mode: '0640'
  when: freeradius_load_user_data | bool

- name: Load user data from SQL dump
  ansible.mysql.mysql_db:
    name: "{{ freeradius_db_name }}"
    state: import
    target: /tmp/radius-seed-data.sql
    login_unix_socket: /run/mysqld/mysqld.sock
  when: freeradius_load_user_data | bool

- name: Clean up user data SQL
  ansible.builtin.file:
    path: /tmp/radius-seed-data.sql
    state: absent
  when: freeradius_load_user_data | bool

- name: Remove default symlinks that conflict with our config
  ansible.builtin.file:
    path: "{{ freeradius_config_dir }}/mods-enabled/{{ item }}"
    state: absent
  loop:
    - sql
  when: false  # only enable when needed

- name: Start and enable freeradius
  ansible.builtin.service:
    name: "{{ freeradius_service_name }}"
    state: started
    enabled: true