---
- name: Set up domain-watchdog
  hosts: domain-watchdog
  become: yes
  tasks:
    - name: default_packages
      ansible.builtin.include_tasks: ../../templates/default_packages.yml

    - name: create_user
      ansible.builtin.include_tasks: ../../templates/create_user.yml
      vars:
        username: nick
        github_user: Chewbaccalakis

    - name: Install Docker
      ansible.builtin.include_tasks: ../../templates/install_docker.yml

    - name: Add nick to docker group
      ansible.builtin.user:
        name: nick
        groups:
          - docker
        append: true

    - name: Deploy Domain Watchdog
      vars:
        # Keep this path: compose prefixes named volumes (database_data etc.)
        # with the directory name, so moving it orphans the existing data.
        domain_watchdog_dir: /opt/domain-watchdog
        # Branch of AtlasHorizon/compose to deploy from; override with
        # `-e compose_branch=<branch>` to test unmerged changes.
        compose_branch: main
      block:
        - name: Create public/content directory
          ansible.builtin.file:
            path: "{{ domain_watchdog_dir }}/public/content"
            state: directory
            mode: "0755"

        # force: true so changes in the compose repo are picked up on reruns;
        # it only reports changed when the content differs.
        - name: Download docker-compose.yml
          ansible.builtin.get_url:
            url: "https://git.atlashorizon.net/AtlasHorizon/compose/raw/branch/{{ compose_branch }}/domain-watchdog/docker-compose.yml"
            dest: "{{ domain_watchdog_dir }}/docker-compose.yml"
            mode: "0644"
            force: true

        # Pulled from Infisical, not generated/persisted to disk. Run this
        # playbook as `infisical run -- ansible-playbook -i inventory ...`
        # with DOMAIN_WATCHDOG_POSTGRES_PASSWORD, DOMAIN_WATCHDOG_APP_SECRET,
        # and DOMAIN_WATCHDOG_JWT_PASSPHRASE secrets set in the workspace.
        - name: Read secrets from environment (populated by `infisical run`)
          ansible.builtin.set_fact:
            domain_watchdog_postgres_password: "{{ lookup('ansible.builtin.env', 'DOMAIN_WATCHDOG_POSTGRES_PASSWORD') }}"
            domain_watchdog_app_secret: "{{ lookup('ansible.builtin.env', 'DOMAIN_WATCHDOG_APP_SECRET') }}"
            domain_watchdog_jwt_passphrase: "{{ lookup('ansible.builtin.env', 'DOMAIN_WATCHDOG_JWT_PASSPHRASE') }}"
          no_log: true

        - name: Verify required secrets were provided
          ansible.builtin.assert:
            that:
              - domain_watchdog_postgres_password | length > 0
              - domain_watchdog_app_secret | length > 0
              - domain_watchdog_jwt_passphrase | length > 0
            fail_msg: >-
              DOMAIN_WATCHDOG_POSTGRES_PASSWORD, DOMAIN_WATCHDOG_APP_SECRET, and
              DOMAIN_WATCHDOG_JWT_PASSPHRASE must be set. Run this playbook via
              `infisical run -- ansible-playbook -i inventory ...` with those
              secrets defined in the workspace.

        - name: Deploy .env file (docker compose variable substitution)
          ansible.builtin.template:
            src: templates/domain-watchdog.env.j2
            dest: "{{ domain_watchdog_dir }}/.env"
            mode: "0600"

        - name: Deploy .env.local file (app secrets)
          ansible.builtin.template:
            src: templates/domain-watchdog.env.local.j2
            dest: "{{ domain_watchdog_dir }}/.env.local"
            mode: "0600"

        - name: Pull prebuilt Domain Watchdog images
          ansible.builtin.command:
            cmd: docker compose pull
            chdir: "{{ domain_watchdog_dir }}"
          changed_when: false

        - name: Start Domain Watchdog via docker compose
          ansible.builtin.command:
            cmd: docker compose up -d
            chdir: "{{ domain_watchdog_dir }}"
          register: domain_watchdog_compose_up
          changed_when: "'Started' in domain_watchdog_compose_up.stderr or 'Created' in domain_watchdog_compose_up.stderr"