---
# file: roles/kibana/tasks/main.yml

- name: Add elasticsearch repo
  yum_repository:
    name: elasticsearch
    description: "Elasticsearch repository for {{ kibana_es_version }}.x packages"
    baseurl:  "https://artifacts.elastic.co/packages/{{ kibana_es_version }}.x/yum"
    gpgcheck: false
    gpgkey: "https://artifacts.elastic.co/GPG-KEY-elasticsearch"
    state: present

- name: Install Kibana
  package:
    name: kibana
    state: latest

- name: Ensure Kibana is running and enabled
  service:
    name: kibana
    state: started
    enabled: true

- name: Enforce the Kibana configuration
  template:
    src: kibana.yml.j2
    dest: /etc/kibana/kibana.yml
    owner: root
    group: root
    mode: 0644
  notify: Restart Kibana

- name: Allow firewall access for approved devices
  firewalld:
    rich_rule: 'rule family=ipv4 source address={{ item }} port port={{ kibana_server_port }} protocol=tcp accept'
    permanent: yes
    immediate: yes
    state: enabled
  loop: "{{ kibana_firewall_access }}"
  notify: Reload firewalld
  when: kibana_firewall_access != ""