---
- name: Installation et configuration du clamAV
  hosts: infra
  become: true
  gather_facts: true
  tasks:
      - name: Vérifier si ClamAV existe dans les dépôts
        ansible.builtin.command: apt-cache search ^clamav$
        register: clamav_search
        changed_when: false

      - name: Afficher résultat
        ansible.builtin.debug:
            var: clamav_search.stdout

      - name: Installer ClamAV si disponible
        ansible.builtin.apt:
            name:
                - clamav
                - clamav-daemon
            state: present
            update_cache: true
        when: clamav_search.stdout != ""

      - name: Démarrer ClamAV
        ansible.builtin.service:
            name: clamav-daemon
            state: started
            enabled: true
        when: clamav_search.stdout != ""

      - name: Arrêter clamav-freshclam avant la mise à jour
        ansible.builtin.service:
            name: clamav-freshclam
            state: stopped
        when: clamav_search.stdout != ""

      - name: Mettre à jour la base de données virale (freshclam)
        ansible.builtin.command: freshclam
        register: freshclam_result
        changed_when: "'Database updated' in freshclam_result.stdout"
        failed_when: freshclam_result.rc != 0
        when: clamav_search.stdout != ""

      - name: Redémarrer clamav-freshclam après la mise à jour
        ansible.builtin.service:
            name: clamav-freshclam
            state: started
            enabled: true
        when: clamav_search.stdout != ""

      - name: Configurer ClamAV - activer la détection PUA
        ansible.builtin.lineinfile:
            path: /etc/clamav/clamd.conf
            regexp: "^#?DetectPUA"
            line: "DetectPUA yes"
            backup: true
        when: clamav_search.stdout != ""
        notify: Redémarrer clamav-daemon

      - name: Configurer ClamAV - activer les logs
        ansible.builtin.lineinfile:
            path: /etc/clamav/clamd.conf
            regexp: "^#?LogFile "
            line: "LogFile /var/log/clamav/clamav.log"
            backup: true
        when: clamav_search.stdout != ""
        notify: Redémarrer clamav-daemon

      - name: Configurer ClamAV - taille max des fichiers scannés
        ansible.builtin.lineinfile:
            path: /etc/clamav/clamd.conf
            regexp: "^#?MaxFileSize"
            line: "MaxFileSize 100M"
            backup: true
        when: clamav_search.stdout != ""
        notify: Redémarrer clamav-daemon

      - name: Planifier un scan quotidien via cron
        ansible.builtin.cron:
            name: "ClamAV daily scan"
            minute: "30"
            hour: "2"
            job: >
                ionice -c 3 nice -n 19
                docker exec gestion-clamav
                clamscan -r /home /tmp /app/uploads
                --log=/var/log/clamav/daily_scan.log --quiet
            user: root
        when: clamav_search.stdout != ""

      - name: Afficher résultat final
        ansible.builtin.debug:
            msg: "ClamAV installé et configuré avec succès"
        when: clamav_search.stdout != ""

      - name: Afficher message si ClamAV non disponible
        ansible.builtin.debug:
            msg: "ClamAV n'est pas disponible dans les dépôts"
        when: clamav_search.stdout == ""

  handlers:
      - name: Redémarrer clamav-daemon
        ansible.builtin.service:
            name: clamav-daemon
            state: restarted