---

- hosts: gateway_server_rw

  tasks:

  - name: Check if file '/etc/ipt-firewall/main_ipv4.conf' exists
    stat:
      path: /etc/ipt-firewall/main_ipv4.conf
    register: main_ipv4_exists

  - name: Check if file '/etc/ipt-firewall/main_ipv6.conf' exists
    stat:
      path: /etc/ipt-firewall/main_ipv6.conf
    register: main_ipv6_exists

  - name: addjust line 'jitsi_tcp_ports' (IPv4)
    lineinfile:
      path: /etc/ipt-firewall/main_ipv4.conf
      regexp: '^jitsi_tcp_ports='
      line: 'jitsi_tcp_ports="$standard_jitsi_tcp_ports"'

  - name: addjust line 'jitsi_tcp_ports' (IPv6)
    lineinfile:
      path: /etc/ipt-firewall/main_ipv6.conf
      regexp: '^jitsi_tcp_ports='
      line: 'jitsi_tcp_ports="$standard_jitsi_tcp_ports"'
    when: 
        - main_ipv6_exists.stat.exists

  - name: addjust line 'jitsi_udp_ports' (IPv4)
    lineinfile:
      path: /etc/ipt-firewall/main_ipv4.conf
      regexp: '^jitsi_udp_ports='
      line: 'jitsi_udp_ports="$standard_jitsi_udp_port_range"'

  - name: addjust line 'jitsi_udp_ports' (IPv6)
    lineinfile:
      path: /etc/ipt-firewall/main_ipv6.conf
      regexp: '^jitsi_udp_ports='
      line: 'jitsi_udp_ports="$standard_jitsi_udp_port_range"'
    when: 
        - main_ipv6_exists.stat.exists

  # ---
  # allow_jitsi_video_conference_out
  # ---

  - name: Check if String 'allow_jitsi_video_conference_out..' (IPv4) is present
    shell: grep -q -E "^allow_jitsi_video_conference_out=" /etc/ipt-firewall/main_ipv4.conf
    register: jitsi_video_conference_out_ipv4_present
    when: main_ipv4_exists.stat.exists
    failed_when: "jitsi_video_conference_out_ipv4_present.rc > 1"
    changed_when: "jitsi_video_conference_out_ipv4_present.rc > 0"

  - name: Adjust file '/etc/ipt-firewall/main_ipv4.conf' (jitsi)
    lineinfile:
      dest: /etc/ipt-firewall/main_ipv4.conf
      state: present
      regexp: '^allow_jitsi_video_conference_out'
      line: 'allow_jitsi_video_conference_out=true'
      insertafter: '^#?\s*allow_mumble_request_out'
    when: 
      - main_ipv4_exists.stat.exists
      - jitsi_video_conference_out_ipv4_present is changed

  - name: Check if String 'allow_jitsi_video_conference_out..' (IPv6) is present
    shell: grep -q -E "^allow_jitsi_video_conference_out=" /etc/ipt-firewall/main_ipv6.conf
    register: jitsi_video_conference_out_ipv6_present
    when: main_ipv6_exists.stat.exists
    failed_when: "jitsi_video_conference_out_ipv6_present.rc > 1"
    changed_when: "jitsi_video_conference_out_ipv6_present.rc > 0"

  - name: Adjust file '/etc/ipt-firewall/main_ipv6.conf' (jitsi)
    lineinfile:
      dest: /etc/ipt-firewall/main_ipv6.conf
      state: present
      regexp: '^allow_jitsi_video_conference_out'
      line: 'allow_jitsi_video_conference_out=true'
      insertafter: '^#?\s*allow_mumble_request_out'
    when: 
      - main_ipv6_exists.stat.exists
      - jitsi_video_conference_out_ipv6_present is changed

  # ---
  # allow_nc_talk_out
  # ---

  - name: Check if String 'allow_nc_talk_out..' (IPv4) is present
    shell: grep -q -E "^allow_nc_talk_out=" /etc/ipt-firewall/main_ipv4.conf
    register: nc_talk_out_ipv4_present
    when: main_ipv4_exists.stat.exists
    failed_when: "nc_talk_out_ipv4_present.rc > 1"
    changed_when: "nc_talk_out_ipv4_present.rc > 0"

  - name: Adjust file '/etc/ipt-firewall/main_ipv4.conf' (jitsi)
    lineinfile:
      dest: /etc/ipt-firewall/main_ipv4.conf
      state: present
      regexp: '^allow_nc_talk_out'
      line: 'allow_nc_talk_out=true'
      insertafter: '^#?\s*allow_jitsi_video_conference_out'
    when: 
      - main_ipv4_exists.stat.exists
      - nc_talk_out_ipv4_present is changed

  - name: Check if String 'allow_nc_talk_out..' (IPv6) is present
    shell: grep -q -E "^allow_nc_talk_out=" /etc/ipt-firewall/main_ipv6.conf
    register: nc_talk_out_ipv6_present
    when: main_ipv6_exists.stat.exists
    failed_when: "nc_talk_out_ipv6_present.rc > 1"
    changed_when: "nc_talk_out_ipv6_present.rc > 0"

  - name: Adjust file '/etc/ipt-firewall/main_ipv6.conf' (jitsi)
    lineinfile:
      dest: /etc/ipt-firewall/main_ipv6.conf
      state: present
      regexp: '^allow_nc_talk_out'
      line: 'allow_nc_talk_out=true'
      insertafter: '^#?\s*allow_jitsi_video_conference_out'
    when: 
      - main_ipv6_exists.stat.exists
      - nc_talk_out_ipv6_present is changed

  # ---
  # jitsi video conference service
  # ---

  - name: Check if String 'jitsi_tcp_ports=..' (IPv4) is present
    shell: grep -q -E "^jitsi_tcp_ports=" /etc/ipt-firewall/main_ipv4.conf
    register: jitsi_service_ipv4_present
    when: main_ipv4_exists.stat.exists
    failed_when: "jitsi_service_ipv4_present.rc > 1"
    changed_when: "jitsi_service_ipv4_present.rc > 0"

  - name: Adjust file '/etc/ipt-firewall/main_ipv4.conf' (jitsi service)
    blockinfile:
      path: /etc/ipt-firewall/main_ipv4.conf
      insertafter: '^#?\s*mumble_ports'
      block: |
        
        # ======
        # - Jitsi Video Conference Service
        # ======

        # - Jitsi Video Conference Service Gateway
        # -
        # - NOT YET IMPLEMENTED
        # -
        local_jitsi_video_conference_service=false

        # - Jitsi Video Conference Service Ports
        # -
        # - TCP 80:    Webinterface.
        # - TCP 443:   Webinterface (SSL)
        # -
        # - UDP 10000-20000:   Virtual Media for Remote Console
        # -
        jitsi_tcp_ports="$standard_jitsi_tcp_ports"
        jitsi_udp_ports="$standard_jitsi_udp_port_range"
      marker: "# Marker set by modify-ipt-gateway.yml (jitsi service)"
    when: 
      - main_ipv4_exists.stat.exists
      - jitsi_service_ipv4_present is changed

  - name: Check if String 'jitsi_tcp_ports=..' (IPv6) is present
    shell: grep -q -E "^jitsi_tcp_ports=" /etc/ipt-firewall/main_ipv6.conf
    register: jitsi_service_ipv6_present
    when: main_ipv6_exists.stat.exists
    failed_when: "jitsi_service_ipv6_present.rc > 1"
    changed_when: "jitsi_service_ipv6_present.rc > 0"

  - name: Adjust file '/etc/ipt-firewall/main_ipv6.conf' (jitsi service)
    blockinfile:
      path: /etc/ipt-firewall/main_ipv6.conf
      insertafter: '^#?\s*mumble_ports'
      block: |
        
        # ======
        # - Jitsi Video Conference Service
        # ======

        # - Jitsi Video Conference Service Gateway
        # -
        # - NOT YET IMPLEMENTED
        # -
        local_jitsi_video_conference_service=false

        # - Jitsi Video Conference Service Ports
        # -
        # - TCP 80:    Webinterface.
        # - TCP 443:   Webinterface (SSL)
        # -
        # - UDP 10000-20000:   Virtual Media for Remote Console
        # -
        jitsi_tcp_ports="$standard_jitsi_tcp_ports"
        jitsi_udp_ports="$standard_jitsi_udp_port_range"
      marker: "# Marker set by modify-ipt-gateway.yml (jitsi service)"
    when: 
      - main_ipv6_exists.stat.exists
      - jitsi_service_ipv6_present is changed


  # ---
  # TURN Server (Stun Server) (for Nextcloud 'talk' app)
  # ---

  - name: Check if String 'nc_turn_ports=..' (IPv4) is present
    shell: grep -q -E "^nc_turn_ports=" /etc/ipt-firewall/main_ipv4.conf
    register: nc_turn_service_ipv4_present
    when: main_ipv4_exists.stat.exists
    failed_when: "nc_turn_service_ipv4_present.rc > 1"
    changed_when: "nc_turn_service_ipv4_present.rc > 0"

  - name: Adjust file '/etc/ipt-firewall/main_ipv4.conf' (nc's turn service)
    blockinfile:
      path: /etc/ipt-firewall/main_ipv4.conf
      insertafter: '^#?\s*jitsi_udp_ports'
      block: |

        # ======
        # - TURN Server (Stun Server) (for Nextcloud 'talk' app)
        # ======

        # - TURN Server (Stun Server) (for Nextcloud 'talk' app)
        # -
        # - NOT YET IMPLEMENTED
        # -
        local_nc_turn_service=""

        # - Ports used by local TURN Server (Stun Server)
        # -
        # - comma separated list
        # -
        nc_turn_ports="$standard_turn_service_ports"
        nc_turn_udp_ports="$standard_turn_service_udp_ports"
      marker: "# Marker set by modify-ipt-gateway.yml (nc's turn service)"
    when: 
      - main_ipv4_exists.stat.exists
      - nc_turn_service_ipv4_present is changed

  - name: Check if String 'nc_turn_ports=..' (IPv6) is present
    shell: grep -q -E "^nc_turn_ports=" /etc/ipt-firewall/main_ipv6.conf
    register: nc_turn_service_ipv6_present
    when: main_ipv6_exists.stat.exists
    failed_when: "nc_turn_service_ipv6_present.rc > 1"
    changed_when: "nc_turn_service_ipv6_present.rc > 0"

  - name: Adjust file '/etc/ipt-firewall/main_ipv6.conf' (jitsi service)
    blockinfile:
      path: /etc/ipt-firewall/main_ipv6.conf
      insertafter: '^#?\s*jitsi_udp_ports'
      block: |

        # ======
        # - TURN Server (Stun Server) (for Nextcloud 'talk' app)
        # ======

        # - TURN Server (Stun Server) (for Nextcloud 'talk' app)
        # -
        # - NOT YET IMPLEMENTED
        # -
        local_nc_turn_service=""

        # - Ports used by local TURN Server (Stun Server)
        # -
        # - comma separated list
        # -
        nc_turn_ports="$standard_turn_service_ports"
        nc_turn_udp_ports="$standard_turn_service_udp_ports"
      marker: "# Marker set by modify-ipt-gateway.yml (jitsi service)"
    when: 
      - main_ipv6_exists.stat.exists
      - nc_turn_service_ipv6_present is changed


  # ---
  # Remove Marker set by blockinfile
  # ---

  - name: Remove marker IPv4
    replace :
      path: /etc/ipt-firewall/main_ipv4.conf
      regexp: "^# Marker set by modify-ipt-gateway.yml.*$"
      replace: ""
    register: marker_ipv4_removed
    #failed_when: "marker_ipv4_removed.rc > 1"
    #changed_when: "marker_ipv4_removed.rc < 1"
    when: 
      - main_ipv4_exists.stat.exists

  - name: Remove marker IPv6
    replace :
      path: /etc/ipt-firewall/main_ipv6.conf
      regexp: "^# Marker set by modify-ipt-gateway.yml.*$"
      replace: ""
    register: marker_ipv6_removed
    #failed_when: "marker_ipv6_removed.rc > 1"
    #changed_when: "marker_ipv6_removed.rc < 1"
    when: 
      - main_ipv6_exists.stat.exists