---
# Advanced Gophish server deployment with enhanced features

- name: Deploy Gophish server
  hosts: localhost
  gather_facts: false
  connection: local
  vars_files:
    - vars.yaml
  vars:
    gophish_instance_type: "{{ gophish_instance_type | default('t3.large') }}"
    gophish_region: "{{ gophish_region | default(aws_region) }}"

  tasks:
    - name: Create Gophish instance
      include_tasks: "../../providers/AWS/tasks/create_instance.yml"
      vars:
        instance_name: "{{ server_name }}"
        instance_type: "{{ gophish_instance_type }}"
        region: "{{ gophish_region }}"
        security_group_rules:
          - { proto: tcp, port: 22, cidr: "{{ operator_ip }}/32", desc: "SSH from operator" }
          - { proto: tcp, port: 3333, cidr: "{{ operator_ip }}/32", desc: "Gophish admin" }
          - { proto: tcp, port: 25, cidr: "{{ mta_front_ip | default('10.0.0.0/8') }}/32", desc: "SMTP from MTA" }
          - { proto: tcp, port: 80, cidr: "{{ phishing_redirector_ip | default('10.0.0.0/8') }}/32", desc: "HTTP from redirector" }

    - name: Add Gophish to inventory
      add_host:
        name: "gophish_server"
        groups: "gophish_servers"
        ansible_host: "{{ instance_ip }}"
        ansible_user: "{{ ansible_user | default('ubuntu') }}"
        ansible_ssh_private_key_file: "{{ ssh_key_path }}"
        ansible_ssh_common_args: "-o StrictHostKeyChecking=no"

- name: Configure Gophish server
  hosts: gophish_servers
  become: true
  gather_facts: true
  vars_files:
    - vars.yaml
  tasks:
    - name: Include advanced Gophish configuration
      include_tasks: "gophish/tasks/configure_gophish_advanced.yml"

    - name: Include security hardening
      include_tasks: "../../common/tasks/security_hardening.yml"

    - name: Include tracker setup
      include_tasks: "../../c2/tasks/configure_integrated_tracker.yml"
      when: deploy_tracker | default(true) | bool