post_addhosts.yml

# SPDX-License-Identifier: Apache-2.0
---

# Execute only on new addhosts, if present.
- name: SAP HANA - Addhosts - Post-Tasks - Set user expiration
  ansible.builtin.include_tasks:
    file: post_tasks/user_expiration.yml
  when:
    - __sap_hana_install_fact_is_new_addhost_host
    - sap_hana_install_set_sidadm_noexpire | d(true)


# Execute on all hosts in play to achieve idempotency.
- name: SAP HANA - Addhosts - Post-Tasks - Update hdbuserstore connection details
  ansible.builtin.include_tasks:
    file: post_tasks/hdbuserstore.yml

- name: SAP HANA - Addhosts - Post-Tasks - SELinux
  ansible.builtin.include_tasks:
    file: post_tasks/selinux.yml
  when: __sap_hana_install_configure_selinux

- name: SAP HANA - Addhosts - Post-Tasks - Fapolicyd
  ansible.builtin.include_tasks:
    file: post_tasks/fapolicyd.yml
  when:
    # Ensure fapolicyd is checked only on supported systems.
    - ansible_facts['os_family'] == "RedHat"
    - __sap_hana_install_configure_fapolicyd
    # Added to ensure that fapolicyd is configured only on new installations
    # to avoid trusting potentially compromised files in existing installation.
    - __sap_hana_install_fact_is_new_addhost_host