- name: Déploiement complet Frontend
  hosts: uber-stup-web
  gather_facts: true
  become: true
  vars:
      domain_name: mln-uber.club
      frontend_dir: /home/ubuntu/frontend
      frontend_port: 5173
  tasks:
      - name: Update and upgrade
        ansible.builtin.apt:
            update_cache: yes
            cache_valid_time: 3600
            upgrade: dist

      - name: Install basic dependencies
        ansible.builtin.apt:
            name:
                - curl
                - nginx
                - tar
                - build-essential
                - certbot
                - python3-certbot-nginx
            state: present
      - name: Créer l'utilisateur de déploiement s'il n'existe pas
        ansible.builtin.user:
            name: "{{ user_deploy }}"
            shell: /bin/bash
            create_home: yes
            state: present

      - name: Ensure /home/{{ user_deploy }} exists with correct permissions
        ansible.builtin.file:
            path: "/home/{{ user_deploy }}"
            state: directory
            owner: "{{ user_deploy }}"
            group: "{{ user_deploy }}"
            mode: "0755"

      - name: Setup Node.js 20 repository
        ansible.builtin.shell: |
            curl -fsSL https://deb.nodesource.com/setup_20.x | bash -
        args:
            executable: /bin/bash
            creates: /etc/apt/sources.list.d/nodesource.list

      - name: Install Node.js 20
        ansible.builtin.apt:
            name: nodejs
            state: present
            update_cache: yes
            dpkg_options: "force-overwrite"

      - name: Verify Node.js and npm versions
        ansible.builtin.shell: |
            node -v
            npm -v
        register: versions_check
        changed_when: false

      - name: Show versions
        ansible.builtin.debug:
            msg: "{{ versions_check.stdout_lines }}"

      - name: Create folder for frontend
        ansible.builtin.file:
            path: "{{ frontend_dir }}"
            state: directory
            owner: "{{ user_deploy }}"
            group: "{{ user_deploy }}"
            mode: "0755"
        tags: frontend

      - name: Synchroniser le frontend (excluant node_modules et .git)
        become_user: "{{ user_deploy }}"
        ansible.builtin.synchronize:
            src: ../frontend-prep/
            dest: "{{ frontend_dir }}/"
            rsync_opts:
                - "--exclude=node_modules"
                - "--exclude=.git"
                - "--exclude=.gitignore"
                - "--exclude=build"
            delete: no
            recursive: yes
            perms: yes
            owner: yes
            rsync_path: rsync
        tags: frontend

      - name: Install npm dependencies
        become_user: "{{ user_deploy }}"
        ansible.builtin.command: npm install
        args:
            chdir: "{{ frontend_dir }}"
        tags: frontend

      - name: Build frontend
        become_user: "{{ user_deploy }}"
        ansible.builtin.command: npm run build
        args:
            chdir: "{{ frontend_dir }}"
        tags: frontend

      - name: Install serve globally
        ansible.builtin.command: npm install -g serve
        tags: frontend

      - name: Création du fichier systemd pour le frontend
        ansible.builtin.copy:
            dest: /etc/systemd/system/frontend.service
            owner: root
            group: root
            mode: "0644"
            content: |
                [Unit]
                Description=Frontend React (serve)
                After=network.target

                [Service]
                User={{ user_deploy }}
                WorkingDirectory={{ frontend_dir }}
                ExecStart=/usr/bin/npx serve -s build -l {{ frontend_port }}
                Restart=always
                RestartSec=5
                Environment="NODE_ENV=production"
                Environment="VITE_TOMTOM_API_KEY=MERY8I7LMeYVSLKO5WuV73W9rKJpBLoB"
                [Install]
                WantedBy=multi-user.target
        notify: Reload systemd
        tags: frontend

      - name: Enable and start frontend service
        ansible.builtin.systemd:
            name: frontend
            state: started
            enabled: yes
            daemon_reload: yes
        tags: frontend

      - name: Configuration UFW
        ansible.builtin.ufw:
            rule: allow
            port: "{{ item }}"
            proto: tcp
        loop:
            - "22"
            - "80"
            - "443"

      - name: Activation du firewall
        ansible.builtin.ufw:
            state: enabled

      - name: Vérifier si un certificat existe déjà
        ansible.builtin.stat:
            path: "/etc/letsencrypt/live/{{ domain_name }}/fullchain.pem"
        register: cert_file
        tags: [certbot]

      - name: Déployer la configuration Nginx HTTP
        ansible.builtin.template:
            src: templates/nginx-frontend.conf.j2
            dest: /etc/nginx/sites-available/frontend
        vars:
            ssl_enabled: false
        tags: [certbot]

      - name: Activation du site Nginx
        ansible.builtin.file:
            src: /etc/nginx/sites-available/frontend
            dest: /etc/nginx/sites-enabled/frontend
            state: link
            force: yes
        tags: [certbot]

      - name: Suppression du site par défaut
        ansible.builtin.file:
            path: /etc/nginx/sites-enabled/default
            state: absent
        tags: [certbot]

      - name: Test de la configuration Nginx
        ansible.builtin.command: nginx -t
        changed_when: false
        tags: [certbot]

      - name: Redémarrage de Nginx
        ansible.builtin.systemd:
            name: nginx
            state: restarted
            enabled: yes
        tags: [certbot]

      # ============================================================
      # Certificat SSL Let's Encrypt
      # ============================================================

      - name: Générer le certificat SSL avec Certbot
        ansible.builtin.command: >
            certbot certonly --nginx
            -d {{ domain_name }}
            --non-interactive
            --agree-tos
            --email admin@{{ domain_name }}
        when: not cert_file.stat.exists
        tags: [certbot]

      # ============================================================
      # Nginx - reconfiguration HTTPS après certificat
      # ============================================================
      - name: Vérifier la présence du certificat
        ansible.builtin.stat:
            path: "/etc/letsencrypt/live/{{ domain_name }}/fullchain.pem"
        register: cert_file_after

      - name: Déployer la configuration Nginx HTTPS
        ansible.builtin.template:
            src: templates/nginx-frontend.conf.j2
            dest: /etc/nginx/sites-available/frontend
        vars:
            ssl_enabled: true
        when: cert_file_after.stat.exists
        notify: Restart nginx
        tags: [nginx]

      - name: Test de la configuration Nginx finale
        ansible.builtin.command: nginx -t
        changed_when: false
        tags: [nginx]

      - name: Redémarrage de Nginx avec SSL
        ansible.builtin.systemd:
            name: nginx
            state: restarted
        when: cert_file_after.stat.exists
        tags: [nginx]

      - name: Vérifier le renouvellement automatique
        ansible.builtin.command: certbot renew --dry-run
        register: certbot_renew
        changed_when: false
        failed_when: false
        tags: [certbot]

      - name: Afficher le statut du renouvellement
        ansible.builtin.debug:
            msg: "{{ certbot_renew.stdout_lines }}"
        tags: [certbot]

  handlers:
      - name: Reload systemd
        ansible.builtin.systemd:
            daemon_reload: yes

      - name: Restart nginx
        ansible.builtin.systemd:
            name: nginx
            state: restarted