---
- name: Collabora / Office (occ, en www-data avec TLS PG)
  become: true
  become_user: "{{ serveur_nextcloud_utilisateur }}"
  environment:
    PGSSLMODE: "{{ serveur_nextcloud_pg_sslmode }}"
    PGSSLROOTCERT: "{{ serveur_nextcloud_ca_racine }}"
  when: not ansible_check_mode
  block:
    - name: Installer + activer l'app richdocuments (idempotent)
      ansible.builtin.shell:
        executable: /bin/bash
        cmd: |
          set -eo pipefail
          OCC="php {{ serveur_nextcloud_racine }}/occ"
          if $OCC app:list | grep -qw richdocuments; then echo SETOPS_OK; else $OCC app:install richdocuments && echo SETOPS_CHANGED; fi
      register: serveur_nextcloud_office_app
      changed_when: "'SETOPS_CHANGED' in serveur_nextcloud_office_app.stdout"

    - name: URL serveur -> Collabora (locale, rapide)
      ansible.builtin.command:
        argv: ["php", "{{ serveur_nextcloud_racine }}/occ", "config:app:set", "richdocuments", "wopi_url", "--value={{ serveur_nextcloud_wopi_url }}"]
      changed_when: false

    - name: Valider la configuration WOPI (autodetection)
      ansible.builtin.command:
        argv: ["php", "{{ serveur_nextcloud_racine }}/occ", "richdocuments:activate-config"]
      changed_when: false

    # Gotcha : public_wopi_url APRES activate-config (qui l'ecrase). Navigateur -> edge.
    - name: URL navigateur -> Collabora (publique, via edge)
      ansible.builtin.command:
        argv:
          - php
          - "{{ serveur_nextcloud_racine }}/occ"
          - config:app:set
          - richdocuments
          - public_wopi_url
          - "--value={{ serveur_nextcloud_wopi_public_url }}"
      changed_when: false