---
- name: Set up Supernote Private Cloud
  hosts: supernote
  become: yes
  tasks:
    - name: default_packages
      ansible.builtin.include_tasks: ../../templates/default_packages.yml

    - name: create_user
      ansible.builtin.include_tasks: ../../templates/create_user.yml
      vars:
        username: nick
        github_user: Chewbaccalakis

    - name: Install Docker
      ansible.builtin.include_tasks: ../../templates/install_docker.yml

    - name: Add nick to docker group
      ansible.builtin.user:
        name: nick
        groups:
          - docker
        append: true

    - name: Deploy Supernote Private Cloud
      vars:
        supernote_dir: /opt/supernote
        # Branch of AtlasHorizon/compose to deploy from; override with
        # `-e compose_branch=main` to test unreleased changes.
        compose_branch: stable
      block:
        - name: Create data persistence directories
          ansible.builtin.file:
            path: "{{ supernote_dir }}/{{ item }}"
            state: directory
            mode: "0755"
          loop:
            - sndata/db_data
            - sndata/config/mysql/conf.d
            - sndata/redis_data
            - sndata/recycle
            - sndata/logs/cloud
            - sndata/logs/app
            - sndata/logs/web
            - sndata/convert
            - supernote_data

        # Downloaded fresh each run so upstream schema changes apply on
        # reruns, per Supernote's own upgrade instructions. docker-compose.yml
        # comes from AtlasHorizon/compose instead (see supernote/README.md
        # there) - the upstream file is missing the initdb mounts this
        # playbook needs.
        - name: Download Supernote database init script
          ansible.builtin.get_url:
            url: https://supernote-private-cloud.supernote.com/cloud/supernotedb.sql
            dest: "{{ supernote_dir }}/supernotedb.sql"
            mode: "0644"
            force: yes

        # force: true so changes in the compose repo are picked up on reruns;
        # it only reports changed when the content differs.
        - name: Download docker-compose.yml
          ansible.builtin.get_url:
            url: "https://git.atlashorizon.net/AtlasHorizon/compose/raw/branch/{{ compose_branch }}/supernote/docker-compose.yml"
            dest: "{{ supernote_dir }}/docker-compose.yml"
            mode: "0644"
            force: true

        # Pulled from Infisical, not generated/persisted to disk. Run this
        # playbook as `infisical run -- ansible-playbook -i inventory ...`
        # with SUPERNOTE_MYSQL_ROOT_PASSWORD, SUPERNOTE_MYSQL_PASSWORD,
        # SUPERNOTE_REDIS_PASSWORD, SUPERNOTE_SMTP_SERVER, SUPERNOTE_SMTP_USER,
        # and SUPERNOTE_SMTP_PASSWORD secrets set in the workspace.
        # SUPERNOTE_SMTP_PORT (default 465) and SUPERNOTE_SMTP_ENCRYPTION
        # (default ssl) are optional.
        - name: Read secrets from environment (populated by `infisical run`)
          ansible.builtin.set_fact:
            supernote_mysql_root_password: "{{ lookup('ansible.builtin.env', 'SUPERNOTE_MYSQL_ROOT_PASSWORD') }}"
            supernote_mysql_password: "{{ lookup('ansible.builtin.env', 'SUPERNOTE_MYSQL_PASSWORD') }}"
            supernote_redis_password: "{{ lookup('ansible.builtin.env', 'SUPERNOTE_REDIS_PASSWORD') }}"
            supernote_smtp_server: "{{ lookup('ansible.builtin.env', 'SUPERNOTE_SMTP_SERVER') }}"
            supernote_smtp_port: "{{ lookup('ansible.builtin.env', 'SUPERNOTE_SMTP_PORT') }}"
            supernote_smtp_user: "{{ lookup('ansible.builtin.env', 'SUPERNOTE_SMTP_USER') }}"
            supernote_smtp_password: "{{ lookup('ansible.builtin.env', 'SUPERNOTE_SMTP_PASSWORD') }}"
            supernote_smtp_encryption: "{{ lookup('ansible.builtin.env', 'SUPERNOTE_SMTP_ENCRYPTION') }}"
          no_log: true

        - name: Verify required secrets were provided
          ansible.builtin.assert:
            that:
              - supernote_mysql_root_password | length > 0
              - supernote_mysql_password | length > 0
              - supernote_redis_password | length > 0
              - supernote_smtp_server | length > 0
              - supernote_smtp_user | length > 0
              - supernote_smtp_password | length > 0
            fail_msg: >-
              SUPERNOTE_MYSQL_ROOT_PASSWORD, SUPERNOTE_MYSQL_PASSWORD,
              SUPERNOTE_REDIS_PASSWORD, SUPERNOTE_SMTP_SERVER,
              SUPERNOTE_SMTP_USER, and SUPERNOTE_SMTP_PASSWORD must be set.
              Run this playbook via `infisical run -- ansible-playbook -i
              inventory ...` with those secrets defined in the workspace.

        - name: Deploy .env file (docker compose variable substitution)
          ansible.builtin.template:
            src: templates/supernote.env.j2
            dest: "{{ supernote_dir }}/.env"
            mode: "0600"

        - name: Deploy SMTP config init script
          ansible.builtin.template:
            src: templates/supernote-email-init.sql.j2
            dest: "{{ supernote_dir }}/supernote-email-init.sql"
            mode: "0600"

        - name: Pull prebuilt Supernote images
          ansible.builtin.command:
            cmd: docker compose pull
            chdir: "{{ supernote_dir }}"
          changed_when: false

        - name: Start Supernote Private Cloud via docker compose
          ansible.builtin.command:
            cmd: docker compose up -d
            chdir: "{{ supernote_dir }}"
          register: supernote_compose_up
          changed_when: "'Started' in supernote_compose_up.stderr or 'Created' in supernote_compose_up.stderr"

        # docker-entrypoint-initdb.d scripts only run once, against an empty
        # database, so reruns wouldn't otherwise pick up SMTP changes made in
        # Infisical. Re-applying here keeps Infisical the source of truth.
        - name: Apply SMTP configuration to the database
          ansible.builtin.shell:
            cmd: >-
              docker compose exec -T -e MYSQL_PWD="{{ supernote_mysql_root_password }}"
              mariadb mysql -u root supernotedb < {{ supernote_dir }}/supernote-email-init.sql
            chdir: "{{ supernote_dir }}"
          changed_when: false
          no_log: true