#
# Copyright (c) 2020 Bubble, Inc.  All rights reserved. For personal (non-commercial) use, see license: https://getbubblenow.com/bubble-license/
#
- name: Set the cert name
  shell: set_cert_name.sh /home/mitmproxy/mitmproxy {{ cert_name }} "{{ cert_org }}" {{ cert_cn }}

- name: Reuse bubble mitm certs if available
  shell: reuse_bubble_mitm_certs.sh

- name: Copy bubble_config.py to /home/mitmproxy/mitmproxy
  template:
    src: bubble_config.py.j2
    dest: /home/mitmproxy/mitmproxy/bubble_config.py
    owner: mitmproxy
    group: mitmproxy
    mode: 0500

- name: Ensure mitmproxy user owns all mitmproxy files
  shell: chown -R mitmproxy /home/mitmproxy/mitmproxy

- name: Install mitm8888 supervisor conf file
  template:
    src: supervisor_mitmproxy.conf.j2
    dest: /etc/supervisor/conf.d/mitm8888.conf
    owner: root
    group: root
    mode: 0400
  vars:
    port: 8888

- name: Install mitm9999 supervisor conf file
  template:
    src: supervisor_mitmproxy.conf.j2
    dest: /etc/supervisor/conf.d/mitm9999.conf
    owner: root
    group: root
    mode: 0400
  vars:
    port: 9999

- name: Install mitmproxy_port file
  copy:
    src: mitmproxy_port
    dest: /home/mitmproxy/mitmproxy_port
    owner: mitmproxy
    group: mitmproxy
    mode: 0600

- name: Install mitm_monitor supervisor conf file
  copy:
    src: supervisor_mitm_monitor.conf
    dest: /etc/supervisor/conf.d/mitm_monitor.conf

- name: Allow mitmproxy private ports
  iptables:
    chain: INPUT
    protocol: tcp
    destination_port: "{{ item }}"
    ctstate: NEW
    syn: match
    jump: ACCEPT
    comment: Accept new connections on mitm port
  become: yes
  tags: algo_related
  with_items:
    - 8888
    - 9999

- name: reload supervisord
  shell: supervisorctl reload
  tags: always
