---
- name: Installer node_exporter
  ansible.builtin.apt:
    name: "{{ client_metrique_paquets }}"
    state: present
    update_cache: true
    cache_valid_time: 3600

# --- TLS : synchroniser le cert step_ca AVANT d'activer --web.config.file ---
- name: TLS — repertoire des certificats (prometheus)
  ansible.builtin.file:
    path: "{{ client_metrique_tls_dir }}"
    state: directory
    owner: prometheus
    group: prometheus
    mode: "0700"
  when: client_metrique_tls_actif | bool

- name: TLS — script de synchronisation du certificat
  ansible.builtin.template:
    src: setops-node-exporter-cert-sync.sh.j2
    dest: /usr/local/sbin/setops-node-exporter-cert-sync
    owner: root
    group: root
    mode: "0755"
  when: client_metrique_tls_actif | bool

- name: TLS — unites de synchronisation (service + path)
  ansible.builtin.template:
    src: "{{ item.s }}"
    dest: "{{ item.d }}"
    owner: root
    group: root
    mode: "0644"
  loop:
    - { s: "setops-node-exporter-cert-sync.service.j2", d: "/etc/systemd/system/setops-node-exporter-cert-sync.service" }
    - { s: "setops-node-exporter-cert-sync.path.j2", d: "/etc/systemd/system/setops-node-exporter-cert-sync.path" }
  loop_control:
    label: "{{ item.d | basename }}"
  when: client_metrique_tls_actif | bool

- name: TLS — activer la surveillance du certificat (path)
  ansible.builtin.systemd:
    name: setops-node-exporter-cert-sync.path
    enabled: true
    state: started
    daemon_reload: true
  when:
    - client_metrique_tls_actif | bool
    - not ansible_check_mode

- name: TLS — synchroniser le certificat maintenant
  ansible.builtin.command: /usr/local/sbin/setops-node-exporter-cert-sync
  changed_when: false
  when:
    - client_metrique_tls_actif | bool
    - not ansible_check_mode

- name: TLS — deployer la web-config de node_exporter
  ansible.builtin.template:
    src: web-config.yml.j2
    dest: "{{ client_metrique_web_config }}"
    owner: root
    group: prometheus
    mode: "0640"
  when: client_metrique_tls_actif | bool
  notify: Redemarrer node_exporter

- name: TLS — verifier la presence du certificat synchronise
  ansible.builtin.stat:
    path: "{{ client_metrique_tls_dir }}/{{ item }}"
  register: client_metrique_tls_stat
  loop:
    - node.crt
    - node.key
  when:
    - client_metrique_tls_actif | bool
    - not ansible_check_mode

- name: TLS — garde-fou, ne pas activer sans certificat en place
  ansible.builtin.assert:
    that:
      - item.stat.exists
    fail_msg: "Cert node_exporter absent ({{ item.item }}) — TLS non active."
  loop: "{{ client_metrique_tls_stat.results | default([]) }}"
  loop_control:
    label: "{{ item.item }}"
  when:
    - client_metrique_tls_actif | bool
    - not ansible_check_mode

- name: Definir les arguments de node_exporter (adresse d'ecoute)
  ansible.builtin.template:
    src: default-node-exporter.j2
    dest: /etc/default/prometheus-node-exporter
    owner: root
    group: root
    mode: "0644"
  notify: Redemarrer node_exporter

- name: Activer et demarrer node_exporter
  ansible.builtin.systemd:
    name: "{{ client_metrique_service }}"
    enabled: true
    state: started