---
- name: Set up caddy LXC
  hosts: caddy
  become: yes
  vars:
    # Where the Caddy admin API listens. OpenTofu manages reverse-proxy routes
    # through this endpoint (caddy_host / caddy_ssh_host in terraform.tfvars).
    caddy_admin_listen: "0.0.0.0:2019"

  handlers:
    - name: restart caddy
      ansible.builtin.systemd:
        name: caddy
        state: restarted
        daemon_reload: yes

  tasks:
    - name: default_packages
      ansible.builtin.include_tasks: ../../templates/default_packages.yml

    - name: create_user
      ansible.builtin.include_tasks: ../../templates/create_user.yml
      vars:
        username: nick
        github_user: Chewbaccalakis

    # Config is deployed BEFORE the caddy package is installed: dpkg keeps a
    # pre-existing /etc/caddy/Caddyfile instead of the package default (which
    # serves a static page on :80 as server "srv0" — that would get autosaved
    # and collide with the OpenTofu-managed :80 server forever after).
    - name: configure caddy
      block:
        - name: create /etc/caddy
          ansible.builtin.file:
            path: /etc/caddy
            state: directory
            mode: '0755'

        - name: deploy Caddyfile (seeds the admin API listener)
          ansible.builtin.template:
            src: templates/Caddyfile.j2
            dest: /etc/caddy/Caddyfile
            owner: root
            group: root
            mode: '0644'
          notify: restart caddy

        - name: create caddy systemd override directory
          ansible.builtin.file:
            path: /etc/systemd/system/caddy.service.d
            state: directory
            mode: '0755'

        - name: override caddy service to resume OpenTofu-applied config
          ansible.builtin.copy:
            dest: /etc/systemd/system/caddy.service.d/resume.conf
            content: |
              # Managed by Ansible. --resume makes Caddy prefer its autosaved
              # JSON config (written whenever OpenTofu applies changes via the
              # admin API) over the Caddyfile, so managed routes survive
              # restarts. The Caddyfile only seeds the initial config; to
              # re-seed from it, delete
              # /var/lib/caddy/.config/caddy/autosave.json and restart caddy.
              [Service]
              ExecStart=
              ExecStart=/usr/bin/caddy run --environ --resume --config /etc/caddy/Caddyfile --adapter caddyfile
            mode: '0644'
          notify: restart caddy

    - name: install caddy
      block:
        - name: install apt prerequisites
          ansible.builtin.apt:
            name:
              - debian-keyring
              - debian-archive-keyring
              - apt-transport-https
            state: present

        - name: download caddy gpg key
          ansible.builtin.shell:
            cmd: curl -1sLf 'https://dl.cloudsmith.io/public/caddy/stable/gpg.key' | gpg --dearmor -o /usr/share/keyrings/caddy-stable-archive-keyring.gpg
            creates: /usr/share/keyrings/caddy-stable-archive-keyring.gpg

        - name: add caddy apt repository
          ansible.builtin.shell:
            cmd: curl -1sLf 'https://dl.cloudsmith.io/public/caddy/stable/debian.deb.txt' | tee /etc/apt/sources.list.d/caddy-stable.list
            creates: /etc/apt/sources.list.d/caddy-stable.list

        - name: download xcaddy gpg key
          ansible.builtin.shell:
            cmd: curl -1sLf 'https://dl.cloudsmith.io/public/caddy/xcaddy/gpg.key' | gpg --dearmor -o /usr/share/keyrings/caddy-xcaddy-archive-keyring.gpg
            creates: /usr/share/keyrings/caddy-xcaddy-archive-keyring.gpg

        - name: add xcaddy apt repository
          ansible.builtin.shell:
            cmd: curl -1sLf 'https://dl.cloudsmith.io/public/caddy/xcaddy/debian.deb.txt' | tee /etc/apt/sources.list.d/caddy-xcaddy.list
            creates: /etc/apt/sources.list.d/caddy-xcaddy.list

        - name: install caddy and xcaddy
          ansible.builtin.apt:
            name:
              - caddy
              - xcaddy
            state: present
            update_cache: yes

    - name: enable and start caddy
      ansible.builtin.systemd:
        name: caddy
        enabled: yes
        state: started
        daemon_reload: yes