---
- name: Check if Elasticsearch config file exists
  ansible.builtin.stat:
    path: /etc/elasticsearch/elasticsearch.yml
  register: elasticsearch_config

- name: Set TLS protocols and cipher suites
  ansible.builtin.lineinfile:
    path: /etc/elasticsearch/elasticsearch.yml
    line: "{{ item }}"
    regexp: "^{{ item.split(':')[0] }}:"
    owner: elasticsearch
    group: elasticsearch
    mode: "0644"
  loop:
    - 'xpack.security.http.ssl.cipher_suites: ["TLS_AES_256_GCM_SHA384", "TLS_AES_128_GCM_SHA256", "TLS_CHACHA20_POLY1305_SHA256", "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256"]' # noqa yaml[line-length]
    - 'xpack.security.http.ssl.supported_protocols: ["TLSv1.3", "TLSv1.2"]'
    - 'xpack.security.transport.ssl.cipher_suites: ["TLS_AES_256_GCM_SHA384", "TLS_AES_128_GCM_SHA256", "TLS_CHACHA20_POLY1305_SHA256", "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256"]' # noqa yaml[line-length]
    - 'xpack.security.transport.ssl.supported_protocols: ["TLSv1.3", "TLSv1.2"]'
  when: elasticsearch_config.stat.exists
  notify: Restart elasticsearch
