---
# Assumes: docker + compose plugin present, the host identity enrolled by roles/ziti_tunneler
# (run-host mode) — that role gains the ACL var + a name assertion (plan §D).
- name: monky_deployd | assert inputs
  ansible.builtin.assert:
    that:
      - monky_deployd_env_id is match('^env-(dev|qa|stage|prod)-[0-9]{2,3}$')
      - monky_deployd_site in ['cbs', 'pdx']
      - monky_deployd_transport in ['sdk', 'proxy', 'system']
    fail_msg: "env_id/site/transport out of grammar"

- name: monky_deployd | prerequisites
  ansible.builtin.apt:
    name: [acl, ca-certificates]
    state: present
    update_cache: true
    cache_valid_time: 3600

- name: monky_deployd | installed version
  ansible.builtin.command: dpkg-query -W -f='${Version}' monky-deployd
  register: monky_deployd_installed
  changed_when: false
  failed_when: false

- name: monky_deployd | download .deb + sha256 from the Gitea release
  when: monky_deployd_installed.stdout != monky_deployd_version
  block:
    - name: monky_deployd | fetch sha256
      ansible.builtin.uri:
        url: "{{ monky_deployd_deb_sha256_url }}"
        return_content: true
      register: monky_deployd_sha
    - name: monky_deployd | fetch .deb (checksum verified)
      ansible.builtin.get_url:
        url: "{{ monky_deployd_deb_url }}"
        dest: "/var/cache/apt/archives/{{ monky_deployd_deb }}"
        checksum: "sha256:{{ monky_deployd_sha.content.split()[0] }}"
        mode: "0644"
    - name: monky_deployd | install .deb
      ansible.builtin.apt:
        deb: "/var/cache/apt/archives/{{ monky_deployd_deb }}"

- name: monky_deployd | identity present
  ansible.builtin.stat:
    path: "{{ monky_deployd_identity }}"
  register: monky_deployd_id_stat
  failed_when: not monky_deployd_id_stat.stat.exists

- name: monky_deployd | ACL so the agent can read the identity
  ansible.posix.acl:
    path: "{{ item.path }}"
    entity: monky-deployd
    etype: user
    permissions: "{{ item.perms }}"
    state: present
  loop:
    - { path: "{{ monky_deployd_identity }}", perms: r }
    - { path: "{{ monky_deployd_identity | dirname }}", perms: rx }

- name: monky_deployd | directories
  ansible.builtin.file:
    path: "{{ item.path }}"
    state: directory
    owner: "{{ item.owner }}"
    group: monky-deployd
    mode: "{{ item.mode }}"
  loop:
    - { path: /etc/monky-deployd, owner: root, mode: "0750" }
    - { path: /var/lib/monky-deployd, owner: monky-deployd, mode: "0700" }

- name: monky_deployd | openbao CA
  ansible.builtin.copy:
    content: "{{ monky_deployd_bao_ca_pem }}"
    dest: /etc/monky-deployd/openbao-ca.pem
    mode: "0644"
  when: monky_deployd_bao_ca_pem | length > 0

- name: monky_deployd | config.yaml
  ansible.builtin.template:
    src: config.yaml.j2
    dest: /etc/monky-deployd/config.yaml
    owner: root
    group: monky-deployd
    mode: "0640"
  notify: monky_deployd tick

- name: monky_deployd | proxy transport env
  ansible.builtin.copy:
    content: "ZITI_IDENTITY={{ monky_deployd_identity }}\n"
    dest: /etc/monky-deployd/proxy.env
    mode: "0644"
  when: monky_deployd_transport == 'proxy'

- name: monky_deployd | proxy service
  ansible.builtin.systemd:
    name: monky-deployd-proxy.service
    enabled: "{{ monky_deployd_transport == 'proxy' }}"
    state: "{{ 'started' if monky_deployd_transport == 'proxy' else 'stopped' }}"
    daemon_reload: true

- name: monky_deployd | bootstrap grant (one-time, from tenancy)
  ansible.builtin.copy:
    content: "{{ monky_deployd_bootstrap_grant }}\n"
    dest: /etc/monky-deployd/bootstrap.jwt
    owner: monky-deployd
    group: monky-deployd
    mode: "0600"
  when: monky_deployd_bootstrap_grant | length > 0
  no_log: true
  notify: monky_deployd tick

- name: monky_deployd | timer
  ansible.builtin.systemd:
    name: monky-deployd.timer
    enabled: "{{ monky_deployd_timer_enabled }}"
    state: "{{ 'started' if monky_deployd_timer_enabled else 'stopped' }}"
    daemon_reload: true

- name: monky_deployd | flush handlers (first tick inside the grant's hour)
  ansible.builtin.meta: flush_handlers

- name: monky_deployd | status
  ansible.builtin.command: monky-deployd status
  register: monky_deployd_status
  changed_when: false
  failed_when: false

- name: monky_deployd | show status
  ansible.builtin.debug:
    msg: "{{ monky_deployd_status.stdout_lines }}"