---
- name: Installation et configuration de Nginx
  hosts: nginx
  become: true
  gather_facts: true

  tasks:
      - name: Installer Nginx
        ansible.builtin.apt:
            name: nginx
            state: present
            update_cache: yes

      - name: Créer le répertoire frontend
        ansible.builtin.file:
            path: "{{ nginx_frontend_path }}"
            state: directory
            owner: www-data
            group: www-data
            mode: "0755"

      - name: Créer le répertoire de logs
        ansible.builtin.file:
            path: /var/log/nginx
            state: directory
            owner: www-data
            group: adm
            mode: "0755"

      - name: Supprimer la config par défaut
        ansible.builtin.file:
            path: /etc/nginx/sites-enabled/default
            state: absent

      - name: Créer la configuration Nginx
        ansible.builtin.template:
            src: ./templates/nginx.conf.j2
            dest: /etc/nginx/sites-available/{{ nginx_app_name }}
        notify: Recharger Nginx

      - name: Activer la configuration
        ansible.builtin.file:
            src: /etc/nginx/sites-available/{{ nginx_app_name }}
            dest: /etc/nginx/sites-enabled/{{ nginx_app_name }}
            state: link
        notify: Recharger Nginx

      - name: Configurer Nginx global settings
        lineinfile:
            path: /etc/nginx/nginx.conf
            regexp: "{{ item.regexp }}"
            line: "{{ item.line }}"
            insertafter: "http {"
        loop:
            - {
                  regexp: '^\s*server_tokens',
                  line: "        server_tokens off;",
              }
            - {
                  regexp: '^\s*client_max_body_size',
                  line: "        client_max_body_size {{ nginx_max_body_size }};",
              }
        notify: Recharger Nginx

      - name: Tester la configuration Nginx
        command: nginx -t
        register: nginx_test
        changed_when: false

      - name: Afficher le résultat du test
        debug:
            var: nginx_test.stderr_lines

      - name: Démarrer Nginx
        ansible.builtin.systemd:
            name: nginx
            state: started
            enabled: yes

      - name: Configurer UFW - Autoriser HTTP
        ansible.builtin.ufw:
            rule: allow
            port: "80"
            proto: tcp
        when: nginx_enable_firewall | default(true)

      - name: Configurer UFW - Bloquer accès direct au backend
        ansible.builtin.ufw:
            rule: deny
            port: "{{ backend_port }}"
            proto: tcp
            from_ip: any
        when: nginx_enable_firewall | default(true)

      - name: Configurer le tunnel
        ansible.builtin.template:
            src: tunnel.conf.j2
            dest: /etc/tunnel.conf
            owner: root
            group: root
            mode: 0644
        notify: Recharger Nginx

  handlers:
      - name: Recharger Nginx
        systemd:
            name: nginx
            state: reloaded