---
- name: créer l'utilisateur système dédié
  ansible.builtin.user:
    name: proxyconsole
    system: true
    shell: /usr/sbin/nologin
    home: "{{ proxy_console_dossier }}"
    create_home: false

- name: créer le dossier de l'application
  ansible.builtin.file:
    path: "{{ proxy_console_dossier }}"
    state: directory
    owner: "{{ ansible_user }}"
    group: "{{ ansible_user }}"
    mode: "0755"

- name: synchroniser le code source
  become: false
  ansible.posix.synchronize:
    src: "{{ playbook_dir }}/../proxy-console/"
    dest: "{{ proxy_console_dossier }}/"
    delete: true
    rsync_opts:
      - "--exclude=proxy-console-linux-amd64"
      - "--exclude=proxy-console"
      - "--exclude=.cache"
      - "--exclude=go"
  register: proxy_console_code_synchronise

- name: compiler le binaire
  ansible.builtin.command:
    cmd: /usr/local/bin/go build -o {{ proxy_console_dossier }}/proxy-console .
  args:
    chdir: "{{ proxy_console_dossier }}"
  environment:
    HOME: "{{ proxy_console_dossier }}"
  register: proxy_console_build
  changed_when: true
  notify: redémarrer proxy-console

- name: donner la propriété du binaire à l'utilisateur dédié
  ansible.builtin.file:
    path: "{{ proxy_console_dossier }}/proxy-console"
    owner: proxyconsole
    group: proxyconsole
    mode: "0750"

# Le mot de passe Redis est déjà généré par le rôle `portail` (même Redis,
# partagé) : on le relit plutôt que d'en gérer un second.
- name: lire le mot de passe Redis de l'app
  ansible.builtin.slurp:
    src: /etc/portail/.env
  register: proxy_console_env_portail_brut

- name: extraire le mot de passe Redis
  ansible.builtin.set_fact:
    proxy_console_redis_mot_de_passe: "{{ proxy_console_env_portail_contenu | regex_search('REDIS_PASSWORD=(.*)', '\\1') | first }}"
  vars:
    proxy_console_env_portail_contenu: "{{ proxy_console_env_portail_brut.content | b64decode }}"
  no_log: true

- name: déployer le fichier d'environnement du service
  ansible.builtin.template:
    src: proxy-console.env.j2
    dest: /etc/proxy-console.env
    owner: root
    group: proxyconsole
    mode: "0640"
  no_log: true
  notify: redémarrer proxy-console

- name: déployer le service systemd
  ansible.builtin.template:
    src: proxy-console.service.j2
    dest: /etc/systemd/system/proxy-console.service
    mode: "0644"
  notify:
    - recharger systemd
    - redémarrer proxy-console

- name: appliquer les changements
  ansible.builtin.meta: flush_handlers

- name: vérifier que le service tourne
  ansible.builtin.systemd:
    name: proxy-console
    enabled: true
    state: started

- name: déployer les scripts de test manuel de la console
  ansible.builtin.copy:
    src: "{{ playbook_dir }}/../proxy-console/{{ item }}"
    dest: "/opt/construction-image/{{ item }}"
    mode: "0644"
  loop:
    - test-manuel.py
    - test-duplication.py