---
- name: Assurer le repertoire des trousseaux apt
  ansible.builtin.file:
    path: /etc/apt/keyrings
    state: directory
    owner: root
    group: root
    mode: "0755"

- name: Telecharger la cle de signature Grafana
  ansible.builtin.get_url:
    url: "{{ serveur_loki_depot_cle_url }}"
    dest: "{{ serveur_loki_depot_cle_fichier }}"
    owner: root
    group: root
    mode: "0644"

- name: Ajouter le depot apt Grafana
  ansible.builtin.apt_repository:
    repo: "{{ serveur_loki_depot_source }}"
    filename: grafana
    state: present

- name: Installer Loki
  ansible.builtin.apt:
    name: "{{ serveur_loki_paquets }}"
    state: present
    update_cache: true

- name: Assurer le groupe loki (le paquet cree l'utilisateur en nogroup)
  ansible.builtin.group:
    name: loki
    system: true

- name: Rattacher l'utilisateur loki a son groupe
  ansible.builtin.user:
    name: loki
    group: loki

- name: Assurer le repertoire de donnees Loki
  ansible.builtin.file:
    path: "{{ serveur_loki_chemin }}"
    state: directory
    owner: loki
    group: loki
    mode: "0750"

# --- TLS : synchroniser le cert step_ca AVANT d'activer http_tls_config ---
- name: TLS — repertoire des certificats (loki)
  ansible.builtin.file:
    path: "{{ serveur_loki_tls_dir }}"
    state: directory
    owner: loki
    group: loki
    mode: "0700"
  when: serveur_loki_tls_actif | bool

- name: TLS — script de synchronisation du certificat
  ansible.builtin.template:
    src: setops-loki-cert-sync.sh.j2
    dest: /usr/local/sbin/setops-loki-cert-sync
    owner: root
    group: root
    mode: "0755"
  when: serveur_loki_tls_actif | bool

- name: TLS — unites de synchronisation (service + path)
  ansible.builtin.template:
    src: "{{ item.s }}"
    dest: "{{ item.d }}"
    owner: root
    group: root
    mode: "0644"
  loop:
    - { s: "setops-loki-cert-sync.service.j2", d: "/etc/systemd/system/setops-loki-cert-sync.service" }
    - { s: "setops-loki-cert-sync.path.j2", d: "/etc/systemd/system/setops-loki-cert-sync.path" }
  loop_control:
    label: "{{ item.d | basename }}"
  when: serveur_loki_tls_actif | bool

- name: TLS — activer la surveillance du certificat (path)
  ansible.builtin.systemd:
    name: setops-loki-cert-sync.path
    enabled: true
    state: started
    daemon_reload: true
  when:
    - serveur_loki_tls_actif | bool
    - not ansible_check_mode

- name: TLS — synchroniser le certificat maintenant
  ansible.builtin.command: /usr/local/sbin/setops-loki-cert-sync
  changed_when: false
  when:
    - serveur_loki_tls_actif | bool
    - not ansible_check_mode

- name: TLS — verifier la presence du certificat synchronise
  ansible.builtin.stat:
    path: "{{ serveur_loki_tls_dir }}/{{ item }}"
  register: serveur_loki_tls_stat
  loop:
    - loki.crt
    - loki.key
  when:
    - serveur_loki_tls_actif | bool
    - not ansible_check_mode

- name: TLS — garde-fou, ne pas activer sans certificat en place
  ansible.builtin.assert:
    that:
      - item.stat.exists
    fail_msg: "Cert Loki absent ({{ item.item }}) — TLS non active."
  loop: "{{ serveur_loki_tls_stat.results | default([]) }}"
  loop_control:
    label: "{{ item.item }}"
  when:
    - serveur_loki_tls_actif | bool
    - not ansible_check_mode

- name: Deployer la configuration Loki
  ansible.builtin.template:
    src: config.yml.j2
    dest: "{{ serveur_loki_config }}"
    owner: root
    group: loki
    mode: "0640"
  notify: Redemarrer loki

- name: Activer et demarrer Loki
  when: not ansible_check_mode
  ansible.builtin.systemd:
    name: "{{ serveur_loki_service }}"
    enabled: true
    state: started