---
- name: Installation et configuration du frontend et backend
  hosts: uber-stup
  become: true
  gather_facts: true

  tasks:
      - name: Update and upgrade
        ansible.builtin.apt:
            update_cache: yes
            cache_valid_time: 3600
            upgrade: "dist"

      - name: install basic dependencies
        ansible.builtin.apt:
            name:
                - curl
                - wget
                - tar
                - rsync
                - acl
                - nginx
                - certbot
                - python3-certbot-nginx
            state: present
            update_cache: yes

      - name: Download Go 1.23.0 tarball
        ansible.builtin.get_url:
            url: https://dl.google.com/go/go1.23.0.linux-amd64.tar.gz
            dest: /tmp/go1.23.0.linux-amd64.tar.gz
            mode: "0644"

      - name: Extract Go 1.23.0
        ansible.builtin.unarchive:
            src: /tmp/go1.23.0.linux-amd64.tar.gz
            dest: /usr/local
            remote_src: yes

      - name: Ensure Go 1.23 is in PATH for all users
        ansible.builtin.lineinfile:
            path: /etc/profile.d/go.sh
            line: "export PATH=/usr/local/go/bin:$PATH"
            create: yes
            state: present
            mode: "0644"

      - name: Check Go versions
        ansible.builtin.shell: |
            echo "Go: $(go version)"
        register: versions_check
        changed_when: false
        failed_when: versions_check.rc != 0

      - name: Display all versions
        ansible.builtin.debug:
            msg: "{{ versions_check.stdout_lines }}"

      # ============================================
      # FRONTEND
      # ============================================

      - name: Create /var/www if not exists
        ansible.builtin.file:
            path: /var/www
            state: directory
            owner: root
            group: root
            mode: "0755"

      - name: Créer l'utilisateur de déploiement s'il n'existe pas
        ansible.builtin.user:
            name: "{{ user_deploy }}"
            shell: /bin/bash
            create_home: yes
            state: present

      - name: Ensure /home/{{ user_deploy }} exists with correct permissions
        ansible.builtin.file:
            path: "/home/{{ user_deploy }}"
            state: directory
            owner: "{{ user_deploy }}"
            group: "{{ user_deploy }}"
            mode: "0755"

      # ============================================
      # BACKEND
      # ============================================

      - name: Create backend directory with deploy user ownership
        ansible.builtin.file:
            path: "{{ backend_dir }}"
            state: directory
            owner: "{{ user_deploy }}"
            group: "{{ user_deploy }}"
            mode: "0755"

      - name: Synchroniser le backend Go
        ansible.builtin.synchronize:
            src: ../backend/gestion/
            dest: "{{ backend_dir }}/"
            rsync_opts:
                - "--exclude=.git"
                - "--exclude=.gitignore"
                - "--exclude=docker-compose.yml"
                - "--exclude=.env"
                - "--no-owner"
                - "--no-group"
            delete: yes
            recursive: yes
        tags: backend

      - name: Fix backend ownership after rsync (rsync tourne en root)
        ansible.builtin.file:
            path: "{{ backend_dir }}"
            owner: "{{ user_deploy }}"
            group: "{{ user_deploy }}"
            recurse: yes
        tags: backend

      - name: Remove old binary if owned by another user
        ansible.builtin.file:
            path: "{{ backend_dir }}/main"
            state: absent
        tags: backend

      - name: Compile backend as deploy user
        become_user: "{{ user_deploy }}"
        ansible.builtin.shell: |
            export PATH=/usr/local/go/bin:$PATH
            go mod tidy
            go build -o main .
        args:
            chdir: "{{ backend_dir }}"
            executable: /bin/bash
        tags: backend

      - name: Set ownership to www-data for runtime
        ansible.builtin.file:
            path: "{{ backend_dir }}"
            owner: "{{ user_web }}"
            group: "{{ user_web }}"
            mode: "0755"
            recurse: yes
        tags: backend

      - name: Set executable permission on backend binary
        ansible.builtin.file:
            path: "{{ backend_binary }}"
            owner: "{{ user_web }}"
            group: "{{ user_web }}"
            mode: "0755"
        tags: backend

      # ============================================
      # SYSTEMD SERVICES
      # ============================================

      - name: Create systemd service for backend
        ansible.builtin.template:
            src: ./templates/backend.service.j2
            dest: /etc/systemd/system/backend.service
            owner: root
            group: root
            mode: "0644"
        tags: backend

      - name: Reload systemd daemon
        ansible.builtin.systemd:
            daemon_reload: yes
        tags: backend

      - name: Enable and restart backend service
        ansible.builtin.systemd:
            name: backend
            enabled: yes
            state: restarted
        tags: backend

      - name: Wait for backend to be ready
        ansible.builtin.wait_for:
            port: "{{ backend_local_port }}"
            delay: 2
            timeout: 30
        tags: backend

      - name: Display service status
        ansible.builtin.shell: |
            echo "=== Backend Service ==="
            systemctl status backend --no-pager || true
        register: service_status
        changed_when: false
        tags: backend

      - name: Show service status
        ansible.builtin.debug:
            msg: "{{ service_status.stdout_lines }}"
        tags: backend

      - name: Configuration UFW
        ansible.builtin.ufw:
            rule: allow
            port: "{{ item }}"
            proto: tcp
        loop:
            - "{{ backend_port }}"
            - 80
            - 22

      - name: Activation du firewall
        ansible.builtin.ufw:
            state: enabled

      - name: Vérifier si un certificat existe déjà
        ansible.builtin.stat:
            path: "/etc/letsencrypt/live/{{ domain_name }}/fullchain.pem"
        register: cert_file
        tags: [certbot]

      - name: Déployer la configuration Nginx HTTP
        ansible.builtin.template:
            src: templates/nginx.conf.j2
            dest: /etc/nginx/sites-available/api
        vars:
            ssl_enabled: false
        tags: [certbot]

      - name: Activation du site Nginx
        ansible.builtin.file:
            src: /etc/nginx/sites-available/api
            dest: /etc/nginx/sites-enabled/api
            state: link
            force: yes
        tags: [certbot]

      - name: Suppression du site par défaut
        ansible.builtin.file:
            path: /etc/nginx/sites-enabled/default
            state: absent
        tags: [certbot]

      - name: Test de la configuration Nginx
        ansible.builtin.command: nginx -t
        changed_when: false
        tags: [certbot]

      - name: Redémarrage de Nginx
        ansible.builtin.systemd:
            name: nginx
            state: restarted
            enabled: yes
        tags: [certbot]

      # ============================================================
      # Certificat SSL Let's Encrypt
      # ============================================================

      - name: Générer le certificat SSL avec Certbot
        ansible.builtin.command: >
            certbot certonly --nginx
            -d {{ domain_name }}
            --non-interactive
            --agree-tos
            --email admin@{{ domain_name }}
        when: not cert_file.stat.exists
        tags: [certbot]

      # ============================================================
      # Nginx - reconfiguration HTTPS après certificat
      # ============================================================
      - name: Vérifier la présence du certificat
        ansible.builtin.stat:
            path: "/etc/letsencrypt/live/{{ domain_name }}/fullchain.pem"
        register: cert_file_after
        tags: [nginx]

      - name: Déployer la configuration Nginx HTTPS
        ansible.builtin.template:
            src: templates/nginx.conf.j2
            dest: /etc/nginx/sites-available/api
        vars:
            ssl_enabled: true
        when: cert_file_after.stat.exists
        notify: Restart nginx
        tags: [nginx]

      - name: Test de la configuration Nginx finale
        ansible.builtin.command: nginx -t
        changed_when: false
        tags: [nginx]

      - name: Redémarrage de Nginx avec SSL
        ansible.builtin.systemd:
            name: nginx
            state: restarted
        when: cert_file_after.stat.exists
        tags: [nginx]

      - name: Vérifier le renouvellement automatique
        ansible.builtin.command: certbot renew --dry-run
        register: certbot_renew
        changed_when: false
        failed_when: false
        tags: [certbot]

      - name: Afficher le statut du renouvellement
        ansible.builtin.debug:
            msg: "{{ certbot_renew.stdout_lines }}"
        tags: [certbot]

  handlers:
      - name: Reload systemd
        ansible.builtin.systemd:
            daemon_reload: yes

      - name: Restart nginx
        ansible.builtin.systemd:
            name: nginx
            state: restarted