---
- name: Add or modify hard nofile limits for wildcard domain
  community.general.pam_limits:
    domain: '*'
    limit_type: '-'
    limit_item: nofile
    value: "{{ nofile }}"

- name: Add or modify hard nproc limits for wildcard domain
  community.general.pam_limits:
    domain: '*'
    limit_type: '-'
    limit_item: nproc
    value: "{{ nproc }}"

- ansible.posix.sysctl:
    name: vm.max_map_count
    value: "{{ vm_max_map_count }}"
    sysctl_set: yes
    state: present
    reload: yes

- ansible.posix.sysctl:
    name: fs.file-max
    value: "{{ fs_file_max }}"
    sysctl_set: yes
    state: present
    reload: yes

- ansible.builtin.file:
    path: /home/ec2-user/.sonar
    owner: ec2-user
    group: ec2-user
    state: directory
    mode: '0755'
    recurse: yes

- ansible.builtin.template:
    src: templates/sonar-secret.txt.j2
    dest: /home/ec2-user/.sonar/sonar-secret.txt
    owner: ec2-user
    group: ec2-user
    mode: '0640'

- name: Install python packages
  ansible.builtin.pip:
    name: "{{ packages }}"
    executable: "/usr/bin/pip3"
  vars:
    packages:
      - docker

- name: ecr docker get-login-password
  shell: "aws --region {{ aws_region }} ecr get-login-password"
  register: ecr_login_password

- name: docker_repository - Log into ECR registry and force re-authorization
  docker_login:
    registry_url: "https://483193324480.dkr.ecr.us-east-1.amazonaws.com"
    username: "AWS"
    password: "{{ ecr_login_password.stdout }}"
    reauthorize: yes

- name: Add a container with SonarQube
  community.docker.docker_container:
    name: sonarqube
    image: "{{ sonar_docker_image }}"
    env:
      SONAR_JDBC_URL: "{{ sonar_jdbc_url }}"
      SONAR_JDBC_USERNAME: "{{ sonar_jdbc_username }}"
      SONAR_JDBC_PASSWORD: "{{ sonar_jdbc_password }}"
    volumes:
      - /home/ec2-user/.sonar:/root/.sonar:ro
      - /home/ec2-user/data:/opt/sonarqube/data
      - /home/ec2-user/logs:/opt/sonarqube/logs
      - /home/ec2-user/extensions:/opt/sonarqube/extensions
    ulimits:
      - "nofile:{{ nofile }}:{{ nofile }}"
      - "nproc:{{ nproc }}:{{ nproc }}"
    restart_policy: unless-stopped
    network_mode: host
    state: started
    stop_timeout: "{{ sonar_stop_timeout }}"