---
# Playbook: deploy-tracearr.yml
#
# But:
# - Copier le docker-compose.yml Tracearr sur le LXC
# - Generer les secrets si absents
# - Demarrer la stack Tracearr
# - Verifier que le port 3000 repond
#
# Les secrets sont crees directement sur le LXC.
# Ils ne sont pas stockes dans Git.

- name: Deploy Tracearr stack
  hosts: tracearr_servers
  become: true
  gather_facts: false

  vars:
    stack_name: tracearr
    stack_path: /opt/stacks/tracearr

  tasks:
    - name: Create stack directory
      file:
        path: "{{ stack_path }}"
        state: directory
        owner: root
        group: root
        mode: "0750"

    - name: Create secrets directory
      file:
        path: "{{ stack_path }}/secrets"
        state: directory
        owner: root
        group: root
        mode: "0700"

    - name: Copy Docker Compose file
      copy:
        src: "{{ playbook_dir }}/../services/tracearr/docker-compose.yml"
        dest: "{{ stack_path }}/docker-compose.yml"
        owner: root
        group: root
        mode: "0644"

    - name: Generate Tracearr secrets if missing
      shell: |
        set -e
        umask 077

        if [ ! -s "{{ stack_path }}/secrets/db_password" ]; then
          openssl rand -hex 32 > "{{ stack_path }}/secrets/db_password"
        fi

        if [ ! -s "{{ stack_path }}/secrets/jwt_secret" ]; then
          openssl rand -hex 32 > "{{ stack_path }}/secrets/jwt_secret"
        fi

        if [ ! -s "{{ stack_path }}/secrets/cookie_secret" ]; then
          openssl rand -hex 32 > "{{ stack_path }}/secrets/cookie_secret"
        fi

        if [ ! -s "{{ stack_path }}/secrets/better_auth_secret" ]; then
          openssl rand -hex 32 > "{{ stack_path }}/secrets/better_auth_secret"
        fi

        if [ ! -s "{{ stack_path }}/secrets/database_url" ]; then
          DB_PASSWORD="$(cat "{{ stack_path }}/secrets/db_password")"
          printf "postgres://tracearr:%s@timescale:5432/tracearr" "$DB_PASSWORD" > "{{ stack_path }}/secrets/database_url"
        fi

        chown -R root:root "{{ stack_path }}/secrets"
        chmod 700 "{{ stack_path }}/secrets"
        chmod 644 "{{ stack_path }}/secrets/"*
      args:
        executable: /bin/bash
      no_log: true
      changed_when: true

    - name: Pull Tracearr stack images
      command: docker compose pull
      args:
        chdir: "{{ stack_path }}"

    - name: Start Tracearr stack
      command: docker compose up -d
      args:
        chdir: "{{ stack_path }}"

    - name: Wait for Tracearr port
      wait_for:
        host: 127.0.0.1
        port: 3000
        timeout: 180

    - name: Show Tracearr containers
      command: docker compose ps
      args:
        chdir: "{{ stack_path }}"
      register: compose_ps
      changed_when: false

    - name: Show compose status
      debug:
        var: compose_ps.stdout_lines