---
# Le certificat mln-uber.club n'est pas généré ici : il existe déjà sur prod-uber
# (utilisé par le conteneur waf du docker-compose). On le récupère et on le copie
# vers le load-balancer. Relancer ce playbook après chaque renouvellement du cert
# sur prod-uber pour resynchroniser HAProxy.

- name: Récupérer le certificat mln-uber.club depuis prod-uber
  hosts: prod-uber
  become: true
  gather_facts: false

  vars:
      # À CONFIRMER : chemin réel du cert sur prod-uber (aucun playbook ne le dépose
      # actuellement à cet endroit — à ajuster si différent).
      app_cert_dir: "{{ docker_dir }}/certs"
      local_cert_sync_dir: /tmp/mln-uber-cert-sync

  tasks:
      - name: Créer le dossier temporaire local de synchronisation
        ansible.builtin.file:
            path: "{{ local_cert_sync_dir }}"
            state: directory
            mode: "0700"
        delegate_to: localhost
        become: false

      - name: Rapatrier fullchain.pem et privkey.pem
        ansible.builtin.fetch:
            src: "{{ app_cert_dir }}/{{ item }}"
            dest: "{{ local_cert_sync_dir }}/{{ item }}"
            flat: true
        loop:
            - fullchain.pem
            - privkey.pem

      - name: Restreindre les permissions locales de la clé privée
        ansible.builtin.file:
            path: "{{ local_cert_sync_dir }}/privkey.pem"
            mode: "0600"
        delegate_to: localhost
        become: false

- name: Déploiement HAProxy (load-balancer)
  hosts: load-balancer
  become: true
  gather_facts: true

  vars:
      haproxy_cert_dir: /etc/haproxy/certs
      haproxy_cert_path: "{{ haproxy_cert_dir }}/{{ domain_name }}.pem"
      local_cert_sync_dir: /tmp/mln-uber-cert-sync

  tasks:
      - name: Installer HAProxy
        ansible.builtin.apt:
            name: haproxy
            state: present
            update_cache: yes

      - name: Créer le dossier des certificats HAProxy
        ansible.builtin.file:
            path: "{{ haproxy_cert_dir }}"
            state: directory
            owner: root
            group: root
            mode: "0750"

      - name: Copier fullchain.pem et privkey.pem sur le load-balancer
        ansible.builtin.copy:
            src: "{{ local_cert_sync_dir }}/{{ item }}"
            dest: "{{ haproxy_cert_dir }}/{{ item }}"
            owner: root
            group: root
            mode: "0640"
        loop:
            - fullchain.pem
            - privkey.pem
        notify: reload haproxy

      - name: Construire le certificat combiné pour HAProxy (fullchain + privkey)
        ansible.builtin.shell: >
            cat {{ haproxy_cert_dir }}/fullchain.pem
            {{ haproxy_cert_dir }}/privkey.pem
            > {{ haproxy_cert_path }}
        notify: reload haproxy

      - name: Restreindre les permissions du certificat combiné
        ansible.builtin.file:
            path: "{{ haproxy_cert_path }}"
            owner: root
            group: root
            mode: "0640"

      - name: Ouvrir le port HTTPS dans UFW
        ansible.builtin.ufw:
            rule: allow
            port: "443"
            proto: tcp

      - name: Déployer la configuration HAProxy
        ansible.builtin.template:
            src: ../templates/haproxy.cfg.j2
            dest: /etc/haproxy/haproxy.cfg
            owner: root
            group: root
            mode: "0644"
            validate: haproxy -c -f %s
        notify: reload haproxy

      - name: Démarrer et activer HAProxy
        ansible.builtin.systemd:
            name: haproxy
            state: started
            enabled: yes

      - name: Nettoyer les fichiers temporaires locaux
        ansible.builtin.file:
            path: "{{ local_cert_sync_dir }}"
            state: absent
        delegate_to: localhost
        become: false

  handlers:
      - name: reload haproxy
        ansible.builtin.systemd:
            name: haproxy
            state: reloaded