---
- name: Initialize Caddy services list
  ansible.builtin.set_fact:
    caddy_services: []

# infra, auth, app (vmm, fw has no podman in it)
- name: Set Caddy infra services list
  ansible.builtin.set_fact:
    caddy_services: >-
      {{
        services
        | dict2items
        | selectattr('value.dependency.web', 'defined')
        | selectattr('value.dependency.web', 'in', ['infra-internal', 'infra-public'])
        | map(attribute='key')
        | list
      }}
  when: node['name'] == 'infra'

- name: Set Caddy auth services list
  ansible.builtin.set_fact:
    caddy_services: >-
      {{
        services
        | dict2items
        | selectattr('value.dependency.web', 'defined')
        | selectattr('value.dependency.web', 'in', ['auth-public', 'infra-public', 'app-public'])
        | map(attribute='key')
        | list
      }}
  when: node['name'] == 'auth'

- name: Set Caddy app services list
  ansible.builtin.set_fact:
    caddy_services: >-
      {{
        services
        | dict2items
        | selectattr('value.dependency.web', 'defined')
        | selectattr('value.dependency.web', 'in', ['app-internal', 'app-public'])
        | map(attribute='key')
        | list
      }}
  when: node['name'] == 'app'

- name: Create caddy directory
  ansible.builtin.file:
    path: "{{ node['home_path'] }}/containers/{{ item }}"
    owner: "{{ ansible_user }}"
    group: "{{ node['group'] }}"
    state: "directory"
    mode: "0770"
  loop:
    - "caddy"
    - "caddy/etc"
    - "caddy/data"
    - "caddy/build"
  become: true

- name: Create caddy log directory for auth
  ansible.builtin.file:
    path: /var/log/caddy
    owner: "{{ ansible_user }}"
    group: "{{ node['group'] }}"
    state: "directory"
    mode: "0755"
  become: true
  when: node['name'] == "auth"

- name: Register acme key to podman secret
  containers.podman.podman_secret:
    name: "CADDY_ACME_KEY"
    data: "{{ hostvars['console']['ca']['acme_key'] }}"
    state: "present"
    force: true
  notify: "notification_restart_caddy"
  no_log: true

- name: Register crowdsec bouncer key to podman secret
  containers.podman.podman_secret:
    name: "CADDY_CROWDSEC_KEY"
    data: "{{ hostvars['console']['crowdsec']['bouncer']['caddy'] }}"
    state: "present"
    force: true
  when: node['name'] == "auth"
  notify: "notification_restart_caddy"
  no_log: true

- name: Deploy containerfile for build
  ansible.builtin.template:
    src: "{{ hostvars['console']['node']['config_path'] }}/services/containers/common/caddy/build/caddy.containerfile.j2"
    dest: "{{ node['home_path'] }}/containers/caddy/build/Containerfile"
    owner: "{{ ansible_user }}"
    group: "{{ node['group'] }}"
    mode: "0640"
  register: "is_caddy_containerfile"
  notify: "notification_restart_caddy"

- name: Deploy root crt for build
  ansible.builtin.copy:
    content: "{{ hostvars['console']['ca']['root']['crt'] }}"
    dest: "{{ node['home_path'] }}/containers/caddy/build/{{ root_cert_filename }}"
    owner: "{{ ansible_user }}"
    group: "{{ node['group'] }}"
    mode: "0640"
  register: "is_caddy_root_crt"
  notify: "notification_restart_caddy"
  no_log: true

- name: Build caddy container image
  containers.podman.podman_image:
    name: "{{ domain['internal'] }}/{{ node['name'] }}/caddy"
    # check tags from container file
    tag: "{{ version['containers']['caddy'] }}"
    state: "build"
    path: "{{ node['home_path'] }}/containers/caddy/build"
    force: "{{ is_caddy_root_crt.changed or is_caddy_containerfile.changed }}"

- name: Prune caddy dangling images
  containers.podman.podman_prune:
    image: true

- name: Deploy caddyfile
  ansible.builtin.template:
    src: "{{ hostvars['console']['node']['config_path'] }}/services/containers/common/caddy/etc/Caddyfile.j2"
    dest: "{{ node['home_path'] }}/containers/caddy/etc/Caddyfile"
    owner: "{{ ansible_user }}"
    group: "{{ node['group'] }}"
    mode: "0600"
  notify: "notification_restart_caddy"

- name: Deploy container file
  ansible.builtin.template:
    src: "{{ hostvars['console']['node']['config_path'] }}/services/containers/common/caddy/caddy.container.j2"
    dest: "{{ node['home_path'] }}/.config/containers/systemd/caddy.container"
    owner: "{{ ansible_user }}"
    group: "{{ node['group'] }}"
    mode: "0644"
  notify: "notification_restart_caddy"

- name: Enable caddy
  ansible.builtin.systemd:
    name: "caddy.service"
    state: "started"
    enabled: true
    daemon_reload: true
    scope: "user"

- name: Check container archive images
  ansible.builtin.stat:
    path: "{{ node['home_path'] }}/archives/containers/{{ domain['internal'] }}_{{ node['name'] }}_caddy_{{ version['containers']['caddy'] }}.tar"
  register: container_archive_images

- name: Save container archive images
  containers.podman.podman_save:
    image:
      - "{{ domain['internal'] }}/{{ node['name'] }}/caddy:{{ version['containers']['caddy'] }}"
    dest: "{{ node['home_path'] }}/archives/containers/{{ domain['internal'] }}_{{ node['name'] }}_caddy_{{ version['containers']['caddy'] }}.tar"
    format: "oci-archive"
    force: "{{ is_caddy_root_crt.changed or is_caddy_containerfile.changed }}"
  when: not container_archive_images.stat.exists or is_caddy_root_crt.changed or is_caddy_containerfile.changed

- name: Fetch container archive images
  ansible.builtin.fetch:
    src: "{{ node['home_path'] }}/archives/containers/{{ domain['internal'] }}_{{ node['name'] }}_caddy_{{ version['containers']['caddy'] }}.tar"
    dest: "{{ hostvars['console']['node']['data_path'] }}/images/containers/"
    flat: true