---

- name: is NRPE present ?
  ansible.builtin.stat:
    path: /etc/nagios/nrpe.d/evolix.cfg
  check_mode: no
  register: nrpe_evolix_config
  tags:
    - mysql
    - nrpe

- name: NRPE user exists for MySQL ?
  ansible.builtin.stat:
    path: ~nagios/.my.cnf
  check_mode: no
  register: nrpe_my_cnf
  tags:
    - mysql
    - nrpe

- block:
  - name: Create a password for NRPE
    ansible.builtin.command:
      cmd: "apg -n 1 -m 16 -M lcN"
    register: mysql_nrpe_password
    check_mode: no
    changed_when: False

  - name: Create nrpe user
    community.mysql.mysql_user:
      name: nrpe
      password: '{{ mysql_nrpe_password.stdout }}'
      priv: "*.*:REPLICATION CLIENT"
      config_file: /root/.my.cnf
      update_password: always
      state: present
    register: create_nrpe_user

  - name: Store credentials in nagios home
    community.general.ini_file:
      dest: "~nagios/.my.cnf"
      owner: nagios
      group: nagios
      mode: "0600"
      section: client
      option: '{{ item.option }}'
      value: '{{ item.value }}'
    loop:
      - { option: 'user', value: 'nrpe' }
      - { option: 'password', value: '{{ mysql_nrpe_password.stdout }}' }
    when: create_nrpe_user is changed

  when:
    - nrpe_evolix_config.stat.exists
    - (not nrpe_my_cnf.stat.exists or (mysql_force_new_nrpe_password | bool))
  tags:
    - mysql
    - nrpe