- name: Create Docker ready LXC
  hosts: "{{ target_node }}"
  become: false
  gather_facts: false

  vars:
    lxc_ctid: 900
    lxc_hostname: docker-test
    lxc_ip: 10.100.5.90/24
    lxc_gateway: 10.100.5.1
    lxc_bridge: vmbr0
    lxc_storage: proxmox-data-nfs
    lxc_template_storage: proxmox-data-nfs
    lxc_template: debian-13-standard_13.1-2_amd64.tar.zst
    lxc_cores: 1
    lxc_memory: 512
    lxc_swap: 512
    lxc_disk: 8

  tasks:
    - name: Check if CT already exists
      command: pct status {{ lxc_ctid }}
      register: ct_status
      changed_when: false
      failed_when: false

    - name: Stop if CT already exists
      fail:
        msg: "CT {{ lxc_ctid }} already exists on this node. Stop to avoid overwrite."
      when: ct_status.rc == 0

    - name: Copy ansible public key to Proxmox node
      copy:
        content: "{{ lookup('file', '/root/.ssh/id_ed25519.pub') }}"
        dest: /tmp/ansible-srv.pub
        owner: root
        group: root
        mode: "0600"

    - name: Create LXC container
      command: >
        pct create {{ lxc_ctid }}
        {{ lxc_template_storage }}:vztmpl/{{ lxc_template }}
        --hostname {{ lxc_hostname }}
        --cores {{ lxc_cores }}
        --memory {{ lxc_memory }}
        --swap {{ lxc_swap }}
        --rootfs {{ lxc_storage }}:{{ lxc_disk }}
        --net0 name=eth0,bridge={{ lxc_bridge }},ip={{ lxc_ip }},gw={{ lxc_gateway }}
        --ostype debian
        --unprivileged 1
        --features nesting=1,keyctl=1
        --ssh-public-keys /tmp/ansible-srv.pub
        --start 1
      register: create_result

    - name: Show create result
      debug:
        var: create_result.stdout_lines

    - name: Wait a few seconds after first boot
      pause:
        seconds: 10

    - name: Update package cache inside CT
      command: pct exec {{ lxc_ctid }} -- apt update
      changed_when: false

    - name: Install base packages inside CT
      command: >
        pct exec {{ lxc_ctid }} --
        apt install -y openssh-server sudo python3 curl ca-certificates gnupg nano
      changed_when: true

    - name: Enable SSH inside CT
      command: pct exec {{ lxc_ctid }} -- systemctl enable --now ssh
      changed_when: true

    - name: Create ansible user inside CT
      command: pct exec {{ lxc_ctid }} -- bash -c "id ansible || useradd -m -s /bin/bash ansible"
      changed_when: true

    - name: Create ansible ssh directory inside CT
      command: pct exec {{ lxc_ctid }} -- mkdir -p /home/ansible/.ssh
      changed_when: true

    - name: Add ansible public key inside CT
      command: >
        pct exec {{ lxc_ctid }} -- bash -c
        'echo "from=\"10.100.5.100\",no-agent-forwarding,no-X11-forwarding,no-port-forwarding {{ lookup("file", "/root/.ssh/id_ed25519.pub") }}" > /home/ansible/.ssh/authorized_keys'
      changed_when: true

    - name: Fix ssh permissions inside CT
      command: >
        pct exec {{ lxc_ctid }} -- bash -c
        "chown -R ansible:ansible /home/ansible/.ssh &&
        chmod 700 /home/ansible/.ssh &&
        chmod 600 /home/ansible/.ssh/authorized_keys"
      changed_when: true

    - name: Configure sudo for ansible user inside CT
      command: >
        pct exec {{ lxc_ctid }} -- bash -c
        "echo 'ansible ALL=(ALL) NOPASSWD:ALL' > /etc/sudoers.d/ansible &&
        chmod 440 /etc/sudoers.d/ansible"
      changed_when: true

    - name: Check sudoers file inside CT
      command: pct exec {{ lxc_ctid }} -- visudo -cf /etc/sudoers.d/ansible
      changed_when: false

    - name: Show final CT status
      command: pct status {{ lxc_ctid }}
      register: final_status
      changed_when: false

    - name: Show final status
      debug:
        var: final_status.stdout