---
- name: Configuration Nextcloud (occ, en www-data avec TLS PG)
  become: true
  become_user: "{{ serveur_nextcloud_utilisateur }}"
  environment:
    PGSSLMODE: "{{ serveur_nextcloud_pg_sslmode }}"
    PGSSLROOTCERT: "{{ serveur_nextcloud_ca_racine }}"
  when: not ansible_check_mode
  block:
    - name: Reglages systeme (overwrite, redis, anti-SSRF)
      ansible.builtin.command:
        argv:
          - php
          - "{{ serveur_nextcloud_racine }}/occ"
          - config:system:set
          - "{{ item.k }}"
          - "--value={{ item.v }}"
          - "{{ item.t | default('--type=string') }}"
      changed_when: false
      loop:
        - { k: "overwrite.cli.url", v: "https://{{ serveur_nextcloud_hostname }}" }
        - { k: "overwritehost", v: "{{ serveur_nextcloud_hostname }}" }
        - { k: "overwriteprotocol", v: "https" }
        # Gotcha : Nextcloud REFUSE les IP privees (SSRF) => OIDC injoignable sans ceci.
        - { k: "allow_local_remote_servers", v: "true", t: "--type=boolean" }
        - { k: "memcache.local", v: "\\OC\\Memcache\\Redis" }
        - { k: "memcache.locking", v: "\\OC\\Memcache\\Redis" }

    - name: Redis (hote + port)
      ansible.builtin.command:
        argv:
          - php
          - "{{ serveur_nextcloud_racine }}/occ"
          - config:system:set
          - redis
          - "{{ item.k }}"
          - "--value={{ item.v }}"
          - "{{ item.t | default('--type=string') }}"
      changed_when: false
      loop:
        - { k: "host", v: "{{ serveur_nextcloud_redis_host }}" }
        - { k: "port", v: "{{ serveur_nextcloud_redis_port }}", t: "--type=integer" }

    - name: Domaines de confiance (trusted_domains)
      ansible.builtin.command:
        argv: ["php", "{{ serveur_nextcloud_racine }}/occ", "config:system:set", "trusted_domains", "{{ idx }}", "--value={{ item }}"]
      changed_when: false
      loop: "{{ serveur_nextcloud_trusted_domains }}"
      loop_control:
        index_var: idx

    - name: Proxy de confiance (edge) — voir la vraie IP client, ne pas throttler l'edge
      ansible.builtin.command:
        argv: ["php", "{{ serveur_nextcloud_racine }}/occ", "config:system:set", "trusted_proxies", "0", "--value={{ serveur_nextcloud_edge_ip }}"]
      changed_when: false
      when: serveur_nextcloud_edge_ip | length > 0

    # Gotcha : Nextcloud a son PROPRE bundle CA (pas le systeme) => OIDC/HTTPS interne echoue sans import.
    - name: Importer le certificat racine step-ca dans le bundle CA de Nextcloud
      ansible.builtin.command:
        argv: ["php", "{{ serveur_nextcloud_racine }}/occ", "security:certificates:import", "{{ serveur_nextcloud_ca_racine }}"]
      changed_when: false

    - name: Whitelister le sous-reseau d'admin (anti-force-brute, plutot que desactiver)
      ansible.builtin.command:
        argv:
          - php
          - "{{ serveur_nextcloud_racine }}/occ"
          - config:system:set
          - "{{ item.k }}"
          - "--value={{ item.v }}"
          - "{{ item.t | default('--type=string') }}"
      changed_when: false
      loop:
        - { k: "bruteForceProtection.whitelist.0.ip", v: "{{ serveur_nextcloud_bruteforce_whitelist.split('/')[0] }}" }
        - { k: "bruteForceProtection.whitelist.0.mask", v: "{{ serveur_nextcloud_bruteforce_whitelist.split('/')[1] }}", t: "--type=integer" }
      when:
        - serveur_nextcloud_bruteforce_whitelist | length > 0
        - "'/' in serveur_nextcloud_bruteforce_whitelist"