---

- block:

  # remove the apt packages as pip packages are going to be installed
  - name: Remove apt python packages
    apt:
      name:
        - "python-protobuf"
        - "python-scipy"
        - "python-numpy"
        - "python-openssl"
      state: "absent"

  - name: Install python packages and dependent libs from apt
    apt:
      name:
        - "uwsgi"
        - "uwsgi-plugin-python"
        - "python-bson"
        - "python-dev"
        - "python-lxml"
        - "python-mako"
        - "python-pygraphviz"
        - "python-tk"
        - "python3.6-tk"
        - "libgeos-dev"
        # The following two libraries are needed to install `dbus-python` using pip
        - "libdbus-1-dev"
        - "libdbus-glib-1-dev"
        - "libssl-dev"
      install_recommends: no
      cache_valid_time: "{{ apt_cache_valid_time }}"
    when: os_release_name == 'trusty'

  - name: Set python versions for trusty
    set_fact:
      python_versions:
        - "2.7"
        - "3.4"
        - "3.6"
    when: os_release_name == 'trusty'

  - name: Set python versions for focal
    set_fact:
      python_versions:
        - "2.7"
        - "3.6"
        - "3.8"
    when: os_release_name == 'focal'

  - name: Copy requirements files
    copy:
      src: "requirements{{ item }}.txt"
      dest: /tmp
    with_items: "{{ python_versions }}"

  - name: Copy requirements uninstall files
    copy:
      src: "requirements_uninstall{{ item }}.txt"
      dest: /tmp
    with_items: "{{ python_versions }}"

  - name: Install python packages
    pip:
      executable: "pip{{ item }}"
      requirements: "/tmp/requirements{{ item }}.txt"
      extra_args: --index-url https://pypi.zooxlabs.com/simple/
    with_items: "{{ python_versions }}"

  - name: Uninstall python packages
    pip:
      executable: "pip{{ item }}"
      state: absent
      requirements: "/tmp/requirements_uninstall{{ item }}.txt"
    with_items: "{{ python_versions }}"
    # This role is run by the dev setup script which does not set `is_live_update`
    when: is_live_update | default(True)

  # Updating to our version of certifi (version 10000+) causes that
  # library to point to the systemwide certificate store so the one that
  # the normal copy of that library ships is unnecessary.  However, the
  # first time we do this upgrade the setup script and whatever called it
  # (e.g., zdeploy or cinder) still has the old copy of certifi loaded
  # in memory, and that copy expects the old location to still exist.
  # We resolve that bootstrapping issue with a symlink that will allow
  # existing processes to continue working.  New processes will ignore
  # it and use the systemwide location directly.
  #
  # This is a temporary measure that was added in February of 2021.
  # Remove this symlink when sufficient time has passed.
  - name: Symlink certifi certificate bundles
    file:
      src: /etc/ssl/certs/ca-certificates.crt
      dest: "/usr/local/lib/python{{ item }}/dist-packages/certifi/cacert.pem"
      state: link
      force: yes
    with_items: "{{ python_versions }}"

  become: yes
