freeradius.yml

---
- name: Add freeradius repository into Ubuntu jammy sources list
  # NOTE: The older version of openwisp.openwisp2 used to install
  # FreeRADIUS 3.0.x on Ubuntu 22.04. After the release of
  # Ubuntu 22.04.1, FreeRADIUS 3.0.x can no longer be installed.
  # This block contains tasks that configures FreeRADIUS server
  # on Ubuntu 22.04 in a backward compatible manner, i.e. if
  # FreeRADIUS 3.0.x is installed on the VM, then the role will continue
  # using FreeRADIUS 3.0.x. On new installations, FreeRADIUS 3.2.x
  # will be used.
  block:
    - name: Check installed FreeRADIUS version
      shell: >
        which freeradius > /dev/null &&
          freeradius -v | sed -n 2p | awk {'print $3'} |
          awk -F '.' {'printf("%1s.%s", $1, $2)'}
      ignore_errors: true
      register: openwisp2_installed_freeradius_version
    - name: Add FreeRADIUS 3.0.x repository to sources list
      shell: >
        echo "deb http://packages.networkradius.com/freeradius-3.0/ubuntu/focal focal main" |
          tee /etc/apt/sources.list.d/networkradius.list > /dev/null
      when: openwisp2_installed_freeradius_version.stdout == '3.0'
    - name: Add FreeRADIUS 3.2.x repository to sources list
      shell: >
        echo "deb http://packages.networkradius.com/freeradius-3.2/ubuntu/jammy jammy main" |
          tee /etc/apt/sources.list.d/networkradius.list > /dev/null
      when: openwisp2_installed_freeradius_version.stdout != '3.0'
    - name: Update freeradius_dir variable
      set_fact:
        freeradius_dir: '/etc/freeradius/3.0'
      when: openwisp2_installed_freeradius_version.stdout == '3.0'

  when:
    - ansible_distribution|string == 'Ubuntu'
    - ansible_distribution_release|string == 'jammy'
  tags:
    - molecule-idempotence-notest

- name: Add freeradius repository into Ubuntu focal sources list
  shell: |
    echo "deb http://packages.networkradius.com/freeradius-3.0/ubuntu/focal focal main" | \
    tee /etc/apt/sources.list.d/networkradius.list > /dev/null
  become: true
  when:
    - ansible_distribution|string == 'Ubuntu'
    - ansible_distribution_release|string == 'focal'
  tags:
    - molecule-idempotence-notest

- name: Add freeradius repository into Ubuntu xenial sources list and Network RADIUS PGP public key
  shell: |
    echo "deb http://packages.networkradius.com/freeradius-3.0/ubuntu/xenial xenial main" | \
    tee /etc/apt/sources.list.d/networkradius.list > /dev/null
    curl -s 'https://packages.networkradius.com/pgp/packages%40networkradius.com' | \
    sudo apt-key add -
  become: true
  when:
    - ansible_distribution|string == 'Ubuntu'
    - ansible_distribution_release|string == 'xenial'
  tags:
    - molecule-idempotence-notest

- name: Add freeradius repository into Debian bullseye sources list
  shell: |
    echo "deb http://packages.networkradius.com/freeradius-3.0/debian/bullseye bullseye main" | \
    sudo tee /etc/apt/sources.list.d/networkradius.list > /dev/null
  become: true
  when:
    - ansible_distribution|string == 'Debian'
    - ansible_distribution_release|string == 'bullseye'
  tags:
    - molecule-idempotence-notest

- name: Add freeradius repository into Debian stretch sources list
  shell: |
    echo "deb http://packages.networkradius.com/freeradius-3.0/debian/stretch stretch main" | \
    sudo tee /etc/apt/sources.list.d/networkradius.list > /dev/null
  become: true
  when:
    - ansible_distribution|string == 'Debian'
    - ansible_distribution_release|string == 'stretch'
  tags:
    - molecule-idempotence-notest

- name: Add Network RADIUS PGP public key
  become: true
  shell: |
    curl -s 'https://packages.networkradius.com/pgp/packages%40networkradius.com' | \
    tee /etc/apt/trusted.gpg.d/packages.networkradius.com.asc > /dev/null
  when:
    - ansible_distribution|string == 'Ubuntu' or ansible_distribution|string == 'Debian'
    - ansible_distribution_release|string != 'xenial'
  tags:
    - molecule-idempotence-notest

- name: Update and upgrade apt packages
  apt:
    upgrade: true
    update_cache: true

- name: Freeradius system packages
  apt:
    name:
      - freeradius-rest
    state: latest
  notify: Restart freeradius

- name: Freeradius postgres packages
  when: freeradius_sql.dialect == "postgresql"
  apt:
    name: freeradius-postgresql
    state: latest
  notify: Restart freeradius

- name: Freeradius mysql packages
  when: freeradius_sql.dialect == "mysql"
  apt:
    name: freeradius-mysql
    state: latest
  notify: Restart freeradius

- name: SQL configuration
  template:
    src: freeradius/sql.j2
    dest: "{{ freeradius_mods_available_dir }}/sql"
    mode: 0640
    owner: freerad
    group: freerad
  notify: Restart freeradius

- name: Enable SQL module
  file:
    src: "{{ freeradius_mods_available_dir }}/sql"
    dest: "{{ freeradius_mods_enabled_dir }}/sql"
    state: link
    mode: 0640
    owner: freerad
    group: freerad

- name: Add plus sign to safe characters
  lineinfile:
    path: "{{ freeradius_mods_config_dir }}/sql/main/{{ freeradius_sql.dialect }}/queries.conf"
    regexp: "^(.*)safe_characters =(.*)$"
    line: 'safe_characters = "{{ freeradius_safe_characters }}"'
    state: present
  notify: Restart freeradius

- name: Adding user 'freerad' to www-data group for database access
  when: freeradius_sql.dialect == "sqlite"
  user:
    name: freerad
    groups: www-data
    append: true

- name: Add Attributes to freeradius dictionary
  lineinfile:
    path: "{{ freeradius_dir }}/dictionary"
    line: "ATTRIBUTE      Expire-After         {{ freeradius_expire_attr_after_seconds }}    integer"

- name: REST configuration
  template:
    src: freeradius/rest.j2
    dest: "{{ freeradius_mods_available_dir }}/rest"
    mode: 0640
    owner: freerad
    group: freerad
  notify: Restart freeradius

- name: Enable REST module
  file:
    src: "{{ freeradius_mods_available_dir }}/rest"
    dest: "{{ freeradius_mods_enabled_dir }}/rest"
    state: link
    mode: 0640
    owner: freerad
    group: freerad

- name: Remove default site
  file:
    dest: "{{ item }}"
    state: absent
  with_items:
    - "{{ freeradius_sites_enabled_dir }}/default"

- name: Site configuration
  template:
    src: "{{ freeradius_openwisp_site_template_src }}"
    dest: "{{ freeradius_sites_enabled_dir }}/openwisp_site"
    mode: 0640
    owner: freerad
    group: freerad
  notify: Restart freeradius

- name: Inner tunnel
  template:
    src: freeradius/inner_tunnel.j2
    dest: "{{ freeradius_sites_enabled_dir }}/inner-tunnel"
    mode: 0640
    owner: freerad
    group: freerad
  notify: Restart freeradius

- name: Copy configuration for WPA Enterprise TTLS
  include_tasks: tasks/freeradius_eap.yml
  loop: "{{ freeradius_eap_orgs }}"
  loop_control:
    loop_var: org
  when: freeradius_eap_orgs
  tags: [freeradius_eap]