---
- name: Mises à jour de sécurité automatiques (unattended-upgrades)
  hosts: load-balancer
  become: true

  tasks:
      - name: Installer unattended-upgrades et jq (notification Discord)
        ansible.builtin.apt:
            name:
                - unattended-upgrades
                - jq
            state: present
            update_cache: true

      - name: Déployer la config des origines/exclusions (50unattended-upgrades)
        ansible.builtin.template:
            src: ../templates/unattended-upgrades-50.j2
            dest: /etc/apt/apt.conf.d/50unattended-upgrades
            owner: root
            group: root
            mode: "0644"

      - name: Déployer la config d'activation périodique (20auto-upgrades)
        ansible.builtin.template:
            src: ../templates/unattended-upgrades-20.j2
            dest: /etc/apt/apt.conf.d/20auto-upgrades
            owner: root
            group: root
            mode: "0644"

      - name: Déployer le script de notification Discord
        ansible.builtin.template:
            src: ../templates/unattended-upgrades-notify.sh.j2
            dest: /usr/local/bin/unattended-upgrades-notify.sh
            owner: root
            group: root
            mode: "0750"

      - name: Déployer le service systemd de notification
        ansible.builtin.template:
            src: ../templates/unattended-upgrades-notify.service.j2
            dest: /etc/systemd/system/unattended-upgrades-notify.service
            owner: root
            group: root
            mode: "0644"
        notify: Recharger systemd

      - name: Déployer le timer systemd de notification
        ansible.builtin.template:
            src: ../templates/unattended-upgrades-notify.timer.j2
            dest: /etc/systemd/system/unattended-upgrades-notify.timer
            owner: root
            group: root
            mode: "0644"
        notify: Recharger systemd

      - name: Activer et démarrer le timer de notification
        ansible.builtin.systemd:
            name: unattended-upgrades-notify.timer
            enabled: true
            state: started
            daemon_reload: true

      - name: Vérifier la config avec un dry-run
        ansible.builtin.command: unattended-upgrade --dry-run --debug
        register: dry_run_result
        changed_when: false
        failed_when: false

      - name: Afficher le résultat du dry-run
        ansible.builtin.debug:
            var: dry_run_result.stdout_lines

  handlers:
      - name: Recharger systemd
        ansible.builtin.systemd:
            daemon_reload: true