---
- name: Set up Grist
  hosts: grist
  become: yes
  tasks:
    - name: default_packages
      ansible.builtin.include_tasks: ../../templates/default_packages.yml

    - name: create_user
      ansible.builtin.include_tasks: ../../templates/create_user.yml
      vars:
        username: nick
        github_user: Chewbaccalakis

    - name: Install Docker
      ansible.builtin.include_tasks: ../../templates/install_docker.yml

    - name: Add nick to docker group
      ansible.builtin.user:
        name: nick
        groups:
          - docker
        append: true

    - name: Deploy Grist
      vars:
        grist_dir: /opt/grist
        grist_hostname: grist.atlashorizon.net
        grist_oidc_issuer_host: auth.atlashorizon.net
      block:
        - name: Create persist directory
          ansible.builtin.file:
            path: "{{ grist_dir }}/persist"
            state: directory
            mode: "0755"

        - name: Deploy docker-compose.yml
          ansible.builtin.copy:
            src: templates/grist-docker-compose.yml
            dest: "{{ grist_dir }}/docker-compose.yml"
            mode: "0644"

        # Pulled from Infisical, not generated/persisted to disk. Run this
        # playbook as `infisical run -- ansible-playbook -i inventory ...`
        # with GRIST_SESSION_SECRET, GRIST_OIDC_IDP_CLIENT_ID, and
        # GRIST_OIDC_IDP_CLIENT_SECRET secrets set in the workspace.
        #
        # The OIDC client must be registered in Authelia with redirect URI
        # https://grist.atlashorizon.net/oauth2/callback.
        - name: Read secrets from environment (populated by `infisical run`)
          ansible.builtin.set_fact:
            grist_session_secret: "{{ lookup('ansible.builtin.env', 'GRIST_SESSION_SECRET') }}"
            grist_oidc_client_id: "{{ lookup('ansible.builtin.env', 'GRIST_OIDC_IDP_CLIENT_ID') }}"
            grist_oidc_client_secret: "{{ lookup('ansible.builtin.env', 'GRIST_OIDC_IDP_CLIENT_SECRET') }}"
          no_log: true

        - name: Verify required secrets were provided
          ansible.builtin.assert:
            that:
              - grist_session_secret | length >= 32
              - grist_oidc_client_id | length > 0
              - grist_oidc_client_secret | length > 0
            fail_msg: >-
              GRIST_SESSION_SECRET (>=32 chars), GRIST_OIDC_IDP_CLIENT_ID, and
              GRIST_OIDC_IDP_CLIENT_SECRET must be set. Run this playbook via
              `infisical run -- ansible-playbook -i inventory ...` with those
              secrets defined in the workspace.

        - name: Deploy .env file (docker compose variable substitution)
          ansible.builtin.template:
            src: templates/grist.env.j2
            dest: "{{ grist_dir }}/.env"
            mode: "0600"

        - name: Pull prebuilt Grist image
          ansible.builtin.command:
            cmd: docker compose pull
            chdir: "{{ grist_dir }}"
          changed_when: false

        - name: Start Grist via docker compose
          ansible.builtin.command:
            cmd: docker compose up -d
            chdir: "{{ grist_dir }}"
          register: grist_compose_up
          changed_when: "'Started' in grist_compose_up.stderr or 'Created' in grist_compose_up.stderr"