---
- name: Déploiement HAProxy (load-balancer)
  hosts: load-balancer
  become: true
  gather_facts: true

  vars:
      haproxy_cert_dir: /etc/haproxy/certs
      haproxy_cert_path: "{{ haproxy_cert_dir }}/{{ domain_name }}.pem"
      local_cert_sync_dir: ../certs

  tasks:
      - name: Installer HAProxy
        ansible.builtin.apt:
            name: haproxy
            state: present
            update_cache: yes

      - name: Créer le dossier des certificats HAProxy
        ansible.builtin.file:
            path: "{{ haproxy_cert_dir }}"
            state: directory
            owner: root
            group: root
            mode: "0750"

      - name: Copier fullchain.pem et privkey.pem sur le load-balancer
        ansible.builtin.copy:
            src: "{{ local_cert_sync_dir }}/{{ item }}"
            dest: "{{ haproxy_cert_dir }}/{{ item }}"
            owner: root
            group: root
            mode: "0640"
        loop:
            - fullchain.pem
            - privkey.pem
        notify: reload haproxy

      - name: Construire le certificat combiné pour HAProxy (fullchain + privkey)
        ansible.builtin.shell: >
            cat {{ haproxy_cert_dir }}/fullchain.pem
            {{ haproxy_cert_dir }}/privkey.pem
            > {{ haproxy_cert_path }}
        notify: reload haproxy

      - name: Restreindre les permissions du certificat combiné
        ansible.builtin.file:
            path: "{{ haproxy_cert_path }}"
            owner: root
            group: root
            mode: "0640"

      - name: Installer iptables-persistent
        ansible.builtin.apt:
            name: iptables-persistent
            state: present
            update_cache: yes

      - name: Autoriser le port HTTPS (443) entrant
        ansible.builtin.iptables:
            chain: INPUT
            protocol: tcp
            destination_port: "443"
            jump: ACCEPT
            action: insert
            comment: "haproxy: autorise HTTPS entrant"

      - name: Sauvegarder les règles iptables (persistance au reboot)
        ansible.builtin.command: netfilter-persistent save
        changed_when: false

      - name: Déployer la configuration HAProxy
        ansible.builtin.template:
            src: ../templates/haproxy.cfg.j2
            dest: /etc/haproxy/haproxy.cfg
            owner: root
            group: root
            mode: "0644"
            validate: haproxy -c -f %s
        notify: reload haproxy

      - name: Démarrer et activer HAProxy
        ansible.builtin.systemd:
            name: haproxy
            state: started
            enabled: yes

  handlers:
      - name: reload haproxy
        ansible.builtin.systemd:
            name: haproxy
            state: reloaded