---
# rn-platform-01: Docker Engine, directory structure, rendered compose file + env files,
# Postgres tuning overlay, reverse proxy config, and the systemd unit that runs it all.
# Docker TLS material and the host firewall are separate roles (docker-tls, firewall) run
# before this one in site.yml — this role assumes both are already in place.

- name: Install Docker Engine
  ansible.builtin.import_tasks: "{{ role_path }}/../common/tasks/docker-engine.yml"

- name: Create data/config directories
  ansible.builtin.file:
    path: "{{ item }}"
    state: directory
    owner: root
    group: docker
    mode: "0750"
  loop:
    - "{{ rootnode_data_root }}/postgres"
    - "{{ rootnode_data_root }}/backups"
    - /opt/rootnode/platform
    - /opt/rootnode/platform/postgresql.conf.d
    - /etc/rootnode/provisioner-config

- name: Deploy Postgres tuning overlay
  ansible.builtin.copy:
    src: "{{ role_path }}/../../../docker/postgres/postgresql.conf.d/00-rootnode-baseline.conf"
    dest: /opt/rootnode/platform/postgresql.conf.d/00-rootnode-baseline.conf
    mode: "0644"
  notify: restart rootnode-platform

- name: Deploy provisioner-config overlay ({{ env }})
  ansible.builtin.copy:
    src: "{{ role_path }}/../../../../environments/{{ env }}/provisioner-config/"
    dest: /etc/rootnode/provisioner-config/
    mode: "0644"
  notify: restart rootnode-platform

- name: Deploy per-service env files (from Ansible Vault-backed variables — see group_vars)
  ansible.builtin.template:
    src: "{{ item }}.env.j2"
    dest: "/etc/rootnode/{{ item }}.env"
    owner: root
    group: root
    mode: "0600"
  loop:
    - platform
    - provisioner
    - gateway
    - postgres
  notify: restart rootnode-platform

- name: Render production docker-compose.yml
  ansible.builtin.template:
    src: "{{ role_path }}/../../../docker/platform/docker-compose.production.yml"
    dest: /opt/rootnode/platform/docker-compose.yml
    owner: root
    group: root
    mode: "0640"
  notify: restart rootnode-platform

- name: Render Caddyfile
  ansible.builtin.template:
    src: "{{ role_path }}/../../../docker/platform/Caddyfile.j2"
    dest: /opt/rootnode/platform/Caddyfile
    owner: root
    group: root
    mode: "0644"
  notify: restart rootnode-platform

- name: Deploy systemd unit
  ansible.builtin.template:
    src: rootnode-platform.service.j2
    dest: /etc/systemd/system/rootnode-platform.service
    mode: "0644"
  notify: restart rootnode-platform

# The `backup` role (applied after this one in site.yml) deploys the backup script and cron —
# kept separate since it also has to run correctly on a host that ISN'T freshly deployed.

- name: Enable and start rootnode-platform
  ansible.builtin.systemd:
    name: rootnode-platform
    enabled: true
    state: started
    daemon_reload: true