---
- name: Génération du certificat SSL Let's Encrypt
  hosts: infra
  become: true
  gather_facts: false

  tasks:
      - name: Installer certbot et le plugin nginx
        ansible.builtin.apt:
            name:
                - certbot
                - python3-certbot-nginx
                - nginx
            state: present
            update_cache: yes

      - name: Déployer la config Nginx HTTP simple (ACME challenge)
        ansible.builtin.copy:
            dest: /etc/nginx/sites-available/certbot
            content: |
                server {
                    listen 80;
                    listen [::]:80;
                    server_name {{ domain_name }} {{ subdomains | join(' ') }};

                    location /.well-known/acme-challenge/ {
                        root /var/www/html;
                    }

                    location / {
                        return 200 'ok';
                        add_header Content-Type text/plain;
                    }
                }

      - name: Activer le site certbot
        ansible.builtin.file:
            src: /etc/nginx/sites-available/certbot
            dest: /etc/nginx/sites-enabled/certbot
            state: link
            force: yes

      - name: Désactiver le site par défaut
        ansible.builtin.file:
            path: /etc/nginx/sites-enabled/default
            state: absent

      - name: Tester la configuration Nginx
        ansible.builtin.command: nginx -t
        changed_when: false

      - name: Redémarrer Nginx
        ansible.builtin.systemd:
            name: nginx
            state: restarted
            enabled: yes

      - name: Ouvrir les ports dans UFW
        ansible.builtin.ufw:
            rule: allow
            port: "{{ item }}"
            proto: tcp
        loop:
            - "22"
            - "80"
            - "443"

      - name: Vérifier si le certificat existe déjà
        ansible.builtin.stat:
            path: "/etc/letsencrypt/live/{{ domain_name }}/fullchain.pem"
        register: cert_file
        tags: [gen]

      - name: Générer le certificat avec Certbot (domaine + sous-domaines)
        ansible.builtin.command: >
            certbot certonly --nginx
            -d {{ domain_name }}
            {{ subdomains | map('regex_replace', '^(.*)$', '-d \1') | join(' ') }}
            --non-interactive
            --agree-tos
            --email admin@{{ domain_name }}
        when: not cert_file.stat.exists
        tags: [gen]

      - name: Vérifier que le certificat a bien été généré
        ansible.builtin.stat:
            path: "/etc/letsencrypt/live/{{ domain_name }}/fullchain.pem"
        register: cert_check

      - name: Afficher le résultat
        ansible.builtin.debug:
            msg: "{{ 'Certificat généré : /etc/letsencrypt/live/' + domain_name + '/fullchain.pem' if cert_check.stat.exists else 'ERREUR : certificat non trouvé' }}"

      - name: Vérifier le renouvellement automatique
        ansible.builtin.command: certbot renew --dry-run
        changed_when: false
        failed_when: false
        when: cert_check.stat.exists

      - name: Créer le dossier docker/certs
        ansible.builtin.file:
            path: "{{ docker_dir }}/nginx/certs"
            state: directory
            owner: "{{ docker_user }}"
            group: "{{ docker_group }}"
            mode: "0750"
        tags: [create]

      - name: Copier fullchain.pem dans docker/certs
        ansible.builtin.copy:
            src: "/etc/letsencrypt/live/{{ domain_name }}/fullchain.pem"
            dest: "{{ docker_dir }}/nginx/certs/fullchain.pem"
            owner: "{{ docker_user }}"
            group: "{{ docker_group }}"
            mode: "0644"
            remote_src: yes
        tags: [create]

      - name: Copier privkey.pem dans docker/certs
        ansible.builtin.copy:
            src: "/etc/letsencrypt/live/{{ domain_name }}/privkey.pem"
            dest: "{{ docker_dir }}/nginx/certs/privkey.pem"
            owner: "{{ docker_user }}"
            group: "{{ docker_group }}"
            mode: "0640"
            remote_src: yes
        tags: [create]