---
# SELinux hardening: enforcing mode plus correct labels for container data.

- name: Enforce SELinux (targeted policy)
  ansible.builtin.selinux:
    policy: targeted
    state: enforcing

- name: Ensure semanage is available
  ansible.builtin.dnf:
    name: policycoreutils-python-utils
    state: present

- name: Add SELinux file context for the Minecraft data directory
  ansible.builtin.command:
    cmd: semanage fcontext -a -t container_file_t "{{ minecraft_data_dir }}(/.*)?"
  register: selinux_fcontext
  changed_when: selinux_fcontext.rc == 0
  failed_when:
    - selinux_fcontext.rc != 0
    - "'already defined' not in (selinux_fcontext.stdout + selinux_fcontext.stderr)"
  when: selinux_set_minecraft_fcontext | bool