---
- name: Exiger les secrets de sauvegarde (Vault)
  ansible.builtin.assert:
    that:
      - client_backup_password | length > 0
      - client_backup_ssh_privkey | length > 0
    fail_msg: "vault_restic_password et vault_backup_ssh_privkey requis."

- name: Installer restic
  ansible.builtin.apt:
    name: "{{ client_backup_paquets }}"
    state: present
    update_cache: true

- name: Créer le répertoire des secrets Set-OPS
  ansible.builtin.file:
    path: /etc/setops
    state: directory
    owner: root
    group: root
    mode: "0700"

- name: Déposer la clé SSH privée de sauvegarde
  ansible.builtin.copy:
    content: "{{ client_backup_ssh_privkey }}"
    dest: "{{ client_backup_ssh_key }}"
    owner: root
    group: root
    mode: "0600"
  no_log: true

- name: Déposer le mot de passe restic
  ansible.builtin.copy:
    content: "{{ client_backup_password }}\n"
    dest: /etc/setops/restic.pass
    owner: root
    group: root
    mode: "0600"
  no_log: true

- name: Assurer /root/.ssh
  ansible.builtin.file:
    path: /root/.ssh
    state: directory
    owner: root
    group: root
    mode: "0700"

- name: Configurer l'accès SSH à la cible de sauvegarde
  ansible.builtin.blockinfile:
    path: /root/.ssh/config
    create: true
    owner: root
    group: root
    mode: "0600"
    marker: "# {mark} SETOPS BACKUP {{ client_backup_cible }}"
    block: |
      Host {{ client_backup_cible }}
          User {{ client_backup_utilisateur_distant }}
          IdentityFile {{ client_backup_ssh_key }}
          IdentitiesOnly yes
          StrictHostKeyChecking accept-new

- name: Assurer le répertoire de préparation des dumps
  ansible.builtin.file:
    path: "{{ client_backup_staging }}"
    state: directory
    owner: root
    group: root
    mode: "0700"

- name: Déployer le script de sauvegarde
  ansible.builtin.template:
    src: sauvegarder.sh.j2
    dest: /usr/local/sbin/setops-sauvegarder.sh
    owner: root
    group: root
    mode: "0700"

- name: Déployer l'unité et le timer systemd
  ansible.builtin.template:
    src: "{{ item.s }}"
    dest: "/etc/systemd/system/{{ item.d }}"
    owner: root
    group: root
    mode: "0644"
  loop:
    - { s: setops-sauvegarde.service.j2, d: setops-sauvegarde.service }
    - { s: setops-sauvegarde.timer.j2, d: setops-sauvegarde.timer }

- name: Activer le timer de sauvegarde
  when: not ansible_check_mode
  ansible.builtin.systemd:
    name: setops-sauvegarde.timer
    enabled: true
    state: started
    daemon_reload: true