---
- name: Exiger le mot de passe admin Keycloak (Vault)
  ansible.builtin.assert:
    that:
      - serveur_keycloak_admin_password | length > 0
    fail_msg: "serveur_keycloak_admin_password est requis (Ansible Vault)."

- name: Resoudre la base de donnees depuis le registre (role partage)
  ansible.builtin.include_role:
    name: resoudre_base
  vars:
    resoudre_base_groupe: "{{ serveur_keycloak_groupe }}"

- name: Adopter les facts de base pour Keycloak
  ansible.builtin.set_fact:
    serveur_keycloak_entree: "{{ resoudre_base_entree }}"
    serveur_keycloak_db_password: "{{ resoudre_base_db_password }}"
    serveur_keycloak_db_host: "{{ resoudre_base_db_host }}"
  no_log: true

- name: Resoudre l'annuaire (role partage)
  ansible.builtin.include_role:
    name: resoudre_annuaire
  when: serveur_keycloak_ldap_federation | bool

- name: Adopter la connexion annuaire pour Keycloak
  ansible.builtin.set_fact:
    serveur_keycloak_ldap_url: "{{ resoudre_annuaire_uri }}:{{ resoudre_annuaire_port }}"
    serveur_keycloak_ldap_users_dn: "{{ resoudre_annuaire_users_dn }}"
    serveur_keycloak_ldap_bind_dn: "{{ resoudre_annuaire_bind_dn }}"
    serveur_keycloak_ldap_bind_password: "{{ resoudre_annuaire_bind_password }}"
  no_log: true
  when: serveur_keycloak_ldap_federation | bool

- name: Installer le JRE
  ansible.builtin.apt:
    name: "{{ serveur_keycloak_java_paquet }}"
    state: present
    update_cache: true
    cache_valid_time: 3600

- name: Creer l'utilisateur systeme keycloak
  ansible.builtin.user:
    name: "{{ serveur_keycloak_utilisateur }}"
    system: true
    home: "{{ serveur_keycloak_home }}"
    create_home: false
    shell: /usr/sbin/nologin

- name: Creer le repertoire d'installation
  ansible.builtin.file:
    path: "{{ serveur_keycloak_home }}"
    state: directory
    owner: "{{ serveur_keycloak_utilisateur }}"
    group: "{{ serveur_keycloak_utilisateur }}"
    mode: "0750"

- name: Telecharger la distribution Keycloak
  ansible.builtin.get_url:
    url: "{{ serveur_keycloak_url }}"
    dest: "/tmp/keycloak-{{ serveur_keycloak_version }}.tar.gz"
    mode: "0644"

- name: Extraire Keycloak
  ansible.builtin.unarchive:
    src: "/tmp/keycloak-{{ serveur_keycloak_version }}.tar.gz"
    dest: "{{ serveur_keycloak_home }}"
    remote_src: true
    extra_opts: ["--strip-components=1"]
    owner: "{{ serveur_keycloak_utilisateur }}"
    group: "{{ serveur_keycloak_utilisateur }}"
    creates: "{{ serveur_keycloak_home }}/bin/kc.sh"

- name: Deployer keycloak.conf (config non sensible)
  ansible.builtin.template:
    src: keycloak.conf.j2
    dest: "{{ serveur_keycloak_home }}/conf/keycloak.conf"
    owner: "{{ serveur_keycloak_utilisateur }}"
    group: "{{ serveur_keycloak_utilisateur }}"
    mode: "0640"
  notify: Redemarrer keycloak

- name: Creer le repertoire de configuration des secrets
  ansible.builtin.file:
    path: /etc/keycloak
    state: directory
    owner: root
    group: "{{ serveur_keycloak_utilisateur }}"
    mode: "0750"

- name: Deployer le fichier d'environnement (secrets)
  ansible.builtin.template:
    src: keycloak.env.j2
    dest: /etc/keycloak/keycloak.env
    owner: root
    group: "{{ serveur_keycloak_utilisateur }}"
    mode: "0640"
  no_log: true
  notify: Redemarrer keycloak

- name: Construire Keycloak (une fois par version)
  ansible.builtin.shell:
    cmd: >-
      {{ serveur_keycloak_home }}/bin/kc.sh build --db=postgres
      && touch {{ serveur_keycloak_home }}/.kc-built-{{ serveur_keycloak_version }}
    creates: "{{ serveur_keycloak_home }}/.kc-built-{{ serveur_keycloak_version }}"
  become: true
  become_user: "{{ serveur_keycloak_utilisateur }}"
  notify: Redemarrer keycloak

- name: Deployer l'unite systemd keycloak
  ansible.builtin.template:
    src: keycloak.service.j2
    dest: /etc/systemd/system/keycloak.service
    owner: root
    group: root
    mode: "0644"
  notify: Redemarrer keycloak

- name: Activer et demarrer keycloak
  when: not ansible_check_mode
  ansible.builtin.systemd:
    name: "{{ serveur_keycloak_service }}"
    enabled: true
    state: started
    daemon_reload: true

- name: Configurer la federation LDAP (realm + provider OpenLDAP)
  ansible.builtin.include_tasks: federation-ldap.yml
  when: serveur_keycloak_ldap_federation | bool

- name: Enregistrer les clients OIDC applicatifs
  ansible.builtin.include_tasks: clients-oidc.yml
  when: serveur_keycloak_clients | length > 0