---
# Aggressive log rotation configuration for privacy
# Reduces log retention time and implements more frequent rotation

- name: Check if default rsyslog logrotate config exists
  stat:
    path: /etc/logrotate.d/rsyslog
  register: rsyslog_logrotate

- name: Disable default rsyslog logrotate to prevent conflicts
  command: mv /etc/logrotate.d/rsyslog /etc/logrotate.d/rsyslog.disabled
  when: rsyslog_logrotate.stat.exists
  changed_when: rsyslog_logrotate.stat.exists

- name: Configure aggressive logrotate for system logs
  template:
    src: privacy-logrotate.j2
    dest: /etc/logrotate.d/99-privacy-enhanced
    mode: '0644'
    owner: root
    group: root
  notify: restart rsyslog

- name: Configure logrotate for auth logs with shorter retention
  template:
    src: auth-logrotate.j2
    dest: /etc/logrotate.d/99-auth-privacy
    mode: '0644'
    owner: root
    group: root
  notify: restart rsyslog

- name: Configure logrotate for kern logs with VPN filtering
  template:
    src: kern-logrotate.j2
    dest: /etc/logrotate.d/99-kern-privacy
    mode: '0644'
    owner: root
    group: root
  notify: restart rsyslog

- name: Set more frequent logrotate execution
  cron:
    name: "Enhanced privacy log rotation"
    job: "/usr/sbin/logrotate /etc/logrotate.conf"
    minute: "0"
    hour: "*/6"
    user: root
    state: present

- name: Create privacy log cleanup script
  template:
    src: privacy-log-cleanup.sh.j2
    dest: /usr/local/bin/privacy-log-cleanup.sh
    mode: '0755'
    owner: root
    group: root

# Note: We don't force immediate rotation as it can cause conflicts
# The new settings will apply on the next scheduled rotation
