# platform = multi_platform_all
# reboot = false
# strategy = configure
# complexity = low
# disruption = medium

- name: 'Ensure Log Files Are Owned By Appropriate User - Set rsyslog logfile configuration facts'
  ansible.builtin.set_fact:
    rsyslog_etc_config: "/etc/rsyslog.conf"

# * And also the log file paths listed after rsyslog's $IncludeConfig directive
#   (store the result into array for the case there's shell glob used as value of IncludeConfig)
# note: on debian operating systems, /bin/sh is a symlink that point to /bin/dash shell. Dash lacks the pipefail option, so the
#   set -o pipefail
# line should be escaped.
- name: 'Ensure Log Files Are Owned By Appropriate User - Get IncludeConfig directive'
  ansible.builtin.shell: |
    set -o pipefail
    grep -e '$IncludeConfig' {{ rsyslog_etc_config }} | cut -d ' ' -f 2 || true
  register: rsyslog_old_inc
  changed_when: False

- name: 'Ensure Log Files Are Owned By Appropriate User - Get include files directives'
  ansible.builtin.shell: |
    set -o pipefail
    awk '/)/{f=0} /include\(/{f=1} f{ nf=gensub("^(include\\(|\\s*)file=\"(\\S+)\".*","\\2",1); if($0!=nf){ print nf }}' {{ rsyslog_etc_config }} || true
  register: rsyslog_new_inc
  changed_when: False

- name: 'Ensure Log Files Are Owned By Appropriate User - Aggregate rsyslog includes'
  ansible.builtin.set_fact:
    include_config_output: "{{ rsyslog_old_inc.stdout_lines + rsyslog_new_inc.stdout_lines }}"
  when: rsyslog_old_inc is not skipped and rsyslog_new_inc is not skipped

- name: 'Ensure Log Files Are Owned By Appropriate User - List all config files'
  ansible.builtin.find:
    paths: "{{ item | dirname }}"
    patterns: "{{ item | basename }}"
    hidden: no
    follow: yes
  loop: "{{ include_config_output | list + [rsyslog_etc_config] }}"
  when: include_config_output is defined
  register: rsyslog_config_files
  failed_when: False
  changed_when: False

- name: 'Ensure Log Files Are Owned By Appropriate User - Extract log files old format'
  ansible.builtin.shell: |
    set -o pipefail
    grep -oP '^[^(\s|#|\$)]+[\s]*.*[\s]+-?(/+[^:;\s]+);*\.*$' {{ item.1.path }} | \
    awk '{print $NF}' | \
    sed -e 's/^-//' || true
  loop: "{{ rsyslog_config_files.results | default([]) | subelements('files') }}"
  register: log_files_old
  changed_when: False
  when: rsyslog_config_files is not skipped

- name: 'Ensure Log Files Are Owned By Appropriate User - Extract log files new format'
  ansible.builtin.shell: |
    set -o pipefail
    grep -iozP "action\s*\(\s*type\s*=\s*\"omfile\"[^\)]*\)" {{ item.1.path }} | \
    grep -iaoP "\bFile\s*=\s*\"([/[:alnum:][:punct:]]*)\"\s*\)" | \
    grep -oE "\"([/[:alnum:][:punct:]]*)\"" | \
    tr -d "\"" | \
    grep -v '^/dev/' || true
  loop: "{{ rsyslog_config_files.results | default([]) | subelements('files') }}"
  register: log_files_new
  changed_when: False
  when: rsyslog_config_files is not skipped

- name: 'Ensure Log Files Are Owned By Appropriate User - Sum all log files found'
  ansible.builtin.set_fact:
    log_files: >-
      {{ log_files_new.results | map(attribute='stdout_lines')
      | list | flatten | unique + log_files_old.results
      | map(attribute='stdout_lines') | list | flatten | unique
      }}

- name: 'Ensure Log Files Are Owned By Appropriate User -Setup log files attribute'
  ansible.builtin.file:
    path: "{{ item }}"
    owner: "syslog"
    state: file
  loop: "{{ log_files | list | flatten | unique }}"
  failed_when: false