- name: Ensure Rainloop allowed domains are set
  ini_file:
    path: /srv/mail/rainloop/data/_data_/_default_/configs/application.ini
    section: security
    option: AllowedDomains
    value: "{{ mail_domains | join(',') }}"
    backup: yes
  notify:
    - Restart Rainloop

- name: Set proper mode of Rainloop data directory
  file:
    path: /srv/mail/rainloop
    state: directory
    recurse: yes
    mode: u+rwX,g+rX

# chown -R always exits 0; changed_when: false suppresses spurious "changed" in playbook output
- name: Set proper ownership of Rainloop data directory
  command: chown -R 991:991 /srv/mail/rainloop
  changed_when: false