---
- name: Exiger la configuration OIDC (client, secret, redirect, upstream, cookie)
  ansible.builtin.assert:
    that:
      - serveur_oauth2_proxy_client_id | length > 0
      - serveur_oauth2_proxy_client_secret | length > 0
      - serveur_oauth2_proxy_redirect_url | length > 0
      - serveur_oauth2_proxy_upstream | length > 0
      - serveur_oauth2_proxy_cookie_secret | length > 0
    fail_msg: "client_id, client_secret (voûte), redirect_url, upstream et cookie_secret (voûte) requis."

- name: Créer l'utilisateur système oauth2-proxy
  ansible.builtin.user:
    name: "{{ serveur_oauth2_proxy_utilisateur }}"
    system: true
    shell: /usr/sbin/nologin
    create_home: false

- name: Télécharger oauth2-proxy
  ansible.builtin.get_url:
    url: "{{ serveur_oauth2_proxy_url }}"
    dest: "/tmp/oauth2-proxy-{{ serveur_oauth2_proxy_version }}.tar.gz"
    mode: "0644"

- name: Extraire le binaire oauth2-proxy
  ansible.builtin.unarchive:
    src: "/tmp/oauth2-proxy-{{ serveur_oauth2_proxy_version }}.tar.gz"
    dest: /usr/local/bin
    remote_src: true
    extra_opts: ["--strip-components=1", "--wildcards", "*/oauth2-proxy"]
    owner: root
    group: root
    mode: "0755"
    creates: "{{ serveur_oauth2_proxy_binaire }}"
  notify: Redémarrer oauth2-proxy

- name: Créer le répertoire de configuration
  ansible.builtin.file:
    path: "{{ serveur_oauth2_proxy_config | dirname }}"
    state: directory
    owner: root
    group: "{{ serveur_oauth2_proxy_utilisateur }}"
    mode: "0750"

- name: Déployer la configuration oauth2-proxy
  ansible.builtin.template:
    src: oauth2-proxy.cfg.j2
    dest: "{{ serveur_oauth2_proxy_config }}"
    owner: root
    group: "{{ serveur_oauth2_proxy_utilisateur }}"
    mode: "0640"
  no_log: true
  notify: Redémarrer oauth2-proxy

- name: Déployer l'unité systemd oauth2-proxy
  ansible.builtin.template:
    src: oauth2-proxy.service.j2
    dest: /etc/systemd/system/oauth2-proxy.service
    owner: root
    group: root
    mode: "0644"
  notify: Redémarrer oauth2-proxy

- name: Activer et démarrer oauth2-proxy
  when: not ansible_check_mode
  ansible.builtin.systemd:
    name: "{{ serveur_oauth2_proxy_service }}"
    enabled: true
    state: started
    daemon_reload: true