Set-OPS-Public/roles/serveur_forgejo/tasks/main.yml

---
- name: Exiger les secrets Forgejo (Vault)
  ansible.builtin.assert:
    that:
      - serveur_forgejo_secret_key | length > 0
      - serveur_forgejo_internal_token | length > 0
      - serveur_forgejo_admin_password | length > 0
    fail_msg: "secret_key, internal_token et admin_password sont requis (Ansible Vault)."

- name: Charger le registre des bases applicatives
  ansible.builtin.include_vars:
    file: "{{ setops_plan_dir }}/bases-donnees.yml"

- name: Resoudre l'entree de base Forgejo (par consommateur)
  ansible.builtin.set_fact:
    serveur_forgejo_entree: >-
      {{ ((bases_donnees | default({})) | dict2items
          | selectattr('value.consommateur', 'defined')
          | selectattr('value.consommateur', 'equalto', serveur_forgejo_groupe)
          | map(attribute='value') | list | first) | default({}) }}      

- name: Exiger l'entree de registre et son secret
  ansible.builtin.assert:
    that:
      - serveur_forgejo_entree.base is defined
      - serveur_forgejo_entree.secret is defined
    fail_msg: "Aucune base avec consommateur '{{ serveur_forgejo_groupe }}' dans instance/plan/bases-donnees.yml."

- name: Resoudre le mot de passe de base (Vault)
  ansible.builtin.set_fact:
    serveur_forgejo_db_password: "{{ lookup('vars', serveur_forgejo_entree.secret) }}"
  no_log: true

- name: Resoudre l'hote et le port du serveur de base de donnees (registre)
  ansible.builtin.set_fact:
    serveur_forgejo_db_host: >-
      {{ (serveurs_bd | default({}))[serveur_forgejo_entree.serveur].hote
         | default(serveur_forgejo_db_host) }}      
    serveur_forgejo_db_port: >-
      {{ (serveurs_bd | default({}))[serveur_forgejo_entree.serveur].port | default(5432) }}      

- name: Creer l'utilisateur systeme git
  ansible.builtin.user:
    name: "{{ serveur_forgejo_utilisateur }}"
    system: true
    shell: /bin/bash
    home: "/home/{{ serveur_forgejo_utilisateur }}"
    create_home: true
    comment: "Git Version Control"

- name: Telecharger le binaire Forgejo
  ansible.builtin.get_url:
    url: "{{ serveur_forgejo_url }}"
    dest: "/usr/local/bin/forgejo-{{ serveur_forgejo_version }}"
    owner: root
    group: root
    mode: "0755"

- name: Activer la version courante du binaire
  ansible.builtin.file:
    src: "/usr/local/bin/forgejo-{{ serveur_forgejo_version }}"
    dest: "{{ serveur_forgejo_binaire }}"
    state: link
  notify: Redemarrer forgejo

- name: Creer les repertoires de donnees
  ansible.builtin.file:
    path: "{{ serveur_forgejo_data }}/{{ item }}"
    state: directory
    owner: "{{ serveur_forgejo_utilisateur }}"
    group: "{{ serveur_forgejo_utilisateur }}"
    mode: "0750"
  loop:
    - ""
    - custom
    - data
    - log

- name: Creer le repertoire de configuration
  ansible.builtin.file:
    path: "{{ serveur_forgejo_config_dir }}"
    state: directory
    owner: root
    group: "{{ serveur_forgejo_utilisateur }}"
    mode: "0770"

- name: Deployer app.ini
  ansible.builtin.template:
    src: app.ini.j2
    dest: "{{ serveur_forgejo_config }}"
    owner: "{{ serveur_forgejo_utilisateur }}"   # Forgejo persiste des secrets générés (oauth2 JWT) → doit pouvoir écrire
    group: "{{ serveur_forgejo_utilisateur }}"
    mode: "0640"
  no_log: true
  notify: Redemarrer forgejo

- name: Deployer l'unite systemd forgejo
  ansible.builtin.template:
    src: forgejo.service.j2
    dest: /etc/systemd/system/forgejo.service
    owner: root
    group: root
    mode: "0644"
  notify: Redemarrer forgejo

- name: Activer et demarrer Forgejo
  when: not ansible_check_mode
  ansible.builtin.systemd:
    name: "{{ serveur_forgejo_service }}"
    enabled: true
    state: started
    daemon_reload: true

- name: Appliquer les redemarrages Forgejo (config a jour) avant admin/OAuth2
  ansible.builtin.meta: flush_handlers

- name: Attendre que Forgejo reponde (migrations terminees)
  ansible.builtin.wait_for:
    host: 127.0.0.1
    port: "{{ serveur_forgejo_http_port }}"
    timeout: 120
  when: not ansible_check_mode

- name: Creer le compte administrateur (une fois)
  ansible.builtin.shell:
    cmd: >-
      {{ serveur_forgejo_binaire }} admin user create
      --admin --username {{ serveur_forgejo_admin_user }}
      --email {{ serveur_forgejo_admin_email }}
      --password '{{ serveur_forgejo_admin_password }}'
      --config {{ serveur_forgejo_config }}
      && touch {{ serveur_forgejo_data }}/.admin-created      
    creates: "{{ serveur_forgejo_data }}/.admin-created"
  become: true
  become_user: "{{ serveur_forgejo_utilisateur }}"
  environment:
    GITEA_WORK_DIR: "{{ serveur_forgejo_data }}"
  no_log: true

- name: Configurer la source OAuth2 SSO (Keycloak, idempotent)
  ansible.builtin.shell:
    executable: /bin/bash
    cmd: |
      set -euo pipefail
      FJ="{{ serveur_forgejo_binaire }} --config {{ serveur_forgejo_config }}"
      if $FJ admin auth list 2>/dev/null | grep -qw "{{ serveur_forgejo_oidc_nom }}"; then
        echo SETOPS_OK
      else
        $FJ admin auth add-oauth \
          --name "{{ serveur_forgejo_oidc_nom }}" \
          --provider openidConnect \
          --key "{{ serveur_forgejo_oidc_client_id }}" \
          --secret "$OIDC_SECRET" \
          --auto-discover-url "{{ serveur_forgejo_oidc_discovery }}" >/dev/null
        echo SETOPS_CHANGED
      fi      
  environment:
    OIDC_SECRET: "{{ serveur_forgejo_oidc_client_secret }}"
    GITEA_WORK_DIR: "{{ serveur_forgejo_data }}"
  become: true
  become_user: "{{ serveur_forgejo_utilisateur }}"
  register: serveur_forgejo_oauth
  changed_when: "'SETOPS_CHANGED' in serveur_forgejo_oauth.stdout"
  no_log: true
  when:
    - serveur_forgejo_oidc_actif | bool
    - not ansible_check_mode