---
- name: Install and Configure Fluent-bit
  hosts: all
  become: yes
  vars:
    s3_bucket: "{{ lookup('env', 's3_bucket') }}"
    s3_region: "{{ lookup('env', 's3_region') }}"
    mount_point: "{{ lookup('env', 'mount_point') }}"
    aws_access_key: ""
    aws_secret_key: ""
    s3_sse: false
  tasks:
    - name: Install required packages
      apt:
        name: 
          - unzip
          - curl
        state: present
        update_cache: yes

    - name: Download AWS CLI installer
      get_url:
        url: https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip
        dest: /tmp/awscliv2.zip
        mode: '0644'

    - name: Extract AWS CLI installer
      unarchive:
        src: /tmp/awscliv2.zip
        dest: /tmp
        remote_src: yes

    - name: Install AWS CLI
      command: /tmp/aws/install
      args:
        creates: /usr/local/bin/aws

    - name: Clean up AWS CLI installer
      file:
        path: "{{ item }}"
        state: absent
      loop:
        - /tmp/awscliv2.zip
        - /tmp/aws

    - name: Add Fluent-bit repository key
      apt_key:
        url: https://packages.fluentbit.io/fluentbit.key
        state: present

    - name: Add Fluent-bit repository
      apt_repository:
        repo: deb https://packages.fluentbit.io/ubuntu/jammy jammy main
        state: present
        filename: fluent-bit

    - name: Install Fluent-bit
      apt:
        name: fluent-bit
        state: present
        update_cache: yes

    - name: Create Fluent-bit directories
      file:
        path: "{{ item }}"
        state: directory
        mode: '0755'
      loop:
        - /fluent-bit/etc
        - /fluent-bit/db
        - /fluent-bit/s3-buffer

    - name: Create fs-audit-trail.yaml configuration
      copy:
        dest: /fluent-bit/etc/fs-audit-trail.yaml
        content: |
          service:
            flush: 15
            daemon: 'off'
            log_level: info
            parsers_file: /fluent-bit/etc/parsers.conf

          pipeline:
            inputs:
              - name: tail
                path: "{{ mount_point }}/.lucid_audit/*/*/*/*.log"
                parser: json
                db: /fluent-bit/db/logs.db
                read_from_head: true
                path_key: source.filename
                offset_key: source.offset

            filters:
              - name: lua
                match: '*'
                call: parse_time
                time_as_table: true
                code: |
                  function parse_time(tag, timestamp, record)
                    local recordTimestamp;
                    if record["timestamp"] then
                      local microseconds = record["timestamp"]
                      recordTimestamp = {
                        sec = math.floor(microseconds / 1000000),
                        nsec = (microseconds % 1000000) * 1000
                      }
                      record["timestamp"] = nil
                      return 1, recordTimestamp, record
                    end
                    return 0, timestamp, record
                  end

            outputs:
              - name: stdout
                match: '*'
              - name: s3
                match: '*'
                bucket: "{{ s3_bucket }}"
                region: "{{ s3_region }}"
                total_file_size: 5M
                upload_timeout: 1m
                preserve_data_ordering: true
                s3_key_format: "/logs/%Y/%m/%d/%H/%M/%S-$UUID.log"
                store_dir: /fluent-bit/s3-buffer
                use_put_object: true
                {%- if s3_sse %}
                s3_server_side_encryption: AES256
                {%- endif %}

    - name: Create json-parser.conf
      copy:
        dest: /fluent-bit/etc/json-parser.conf
        content: |
          [PARSER]
              Name        json 
              Format      json
              Time_Key    timestamp
              Time_Format %s

    - name: Configure system file descriptor limits
      copy:
        dest: /etc/security/limits.d/fluent-bit.conf
        content: |
          *    soft    nofile    65535
          *    hard    nofile    65535
        mode: '0644'

    - name: Configure AWS credentials if provided
      block:
        - name: Create AWS credentials directory
          file:
            path: /root/.aws
            state: directory
            mode: '0700'
          when: aws_access_key != '' and aws_secret_key != ''

        - name: Configure AWS credentials
          copy:
            content: |
              [default]
              aws_access_key_id = {{ aws_access_key }}
              aws_secret_access_key = {{ aws_secret_key }}
              region = {{ s3_region }}
            dest: /root/.aws/credentials
            mode: '0600'
          when: aws_access_key != '' and aws_secret_key != ''
      when: aws_access_key != '' and aws_secret_key != ''

    - name: Create Fluent-bit systemd service
      copy:
        dest: /etc/systemd/system/fluent-bit-s3.service
        content: |
          [Unit]
          Description=Fluent Bit S3 Service
          After=network.target

          [Service]
          ExecStart=/opt/fluent-bit/bin/fluent-bit -c /fluent-bit/etc/fs-audit-trail.yaml -R /fluent-bit/etc/json-parser.conf
          Restart=always
          User=root
          Group=root
          LimitNOFILE=65535

          [Install]
          WantedBy=multi-user.target

    - name: Reload systemd daemon
      systemd:
        daemon_reload: yes

    - name: Enable and start Fluent-bit service
      systemd:
        name: fluent-bit-s3
        enabled: yes
        state: started
