# Alliance Boréale - Rôle Keycloak
# Couche: C3 (Gouvernance & Supervision)
# Objectif: Déployer IdP fédéré (SSO)
# Date: 2025-10-31

---
- name: "📦 Install dependencies"
  ansible.builtin.apt:
    name:
      - openjdk-17-jre-headless
      - python3-pip
      - python3-psycopg2
      - nginx
      - openssl
    state: present
    update_cache: true
  tags: keycloak

- name: "👤 Create keycloak user"
  ansible.builtin.user:
    name: keycloak
    system: true
    shell: /bin/false
    home: /opt/keycloak
    create_home: false
  tags: keycloak

- name: "📁 Create keycloak directories"
  ansible.builtin.file:
    path: "{{ item }}"
    state: directory
    owner: keycloak
    group: keycloak
    mode: '0755'
  loop:
    - /opt/keycloak
    - /var/log/keycloak
  tags: keycloak

- name: "📥 Download Keycloak"
  ansible.builtin.get_url:
    url: "https://github.com/keycloak/keycloak/releases/download/{{ keycloak.version }}/keycloak-{{ keycloak.version }}.tar.gz"
    dest: "/tmp/keycloak-{{ keycloak.version }}.tar.gz"
    mode: '0644'
  tags: keycloak

- name: "📦 Extract Keycloak"
  ansible.builtin.unarchive:
    src: "/tmp/keycloak-{{ keycloak.version }}.tar.gz"
    dest: /opt/keycloak
    remote_src: true
    owner: keycloak
    group: keycloak
    extra_opts: [--strip-components=1]
    creates: /opt/keycloak/bin/kc.sh
  tags: keycloak

- name: "🗄️ Configure PostgreSQL for Keycloak"
  ansible.builtin.import_tasks: database.yml
  tags: keycloak

- name: "⚙️ Configure Keycloak"
  ansible.builtin.template:
    src: keycloak.conf.j2
    dest: /opt/keycloak/conf/keycloak.conf
    owner: keycloak
    group: keycloak
    mode: '0640'
  notify: restart keycloak
  tags: keycloak

- name: "🔨 Build Keycloak"
  ansible.builtin.command:
    cmd: /opt/keycloak/bin/kc.sh build
  become: true
  become_user: keycloak
  args:
    creates: /opt/keycloak/lib/quarkus/quarkus-application.dat
  tags: keycloak

- name: "⚙️ Create systemd service"
  ansible.builtin.template:
    src: keycloak.service.j2
    dest: /etc/systemd/system/keycloak.service
    owner: root
    group: root
    mode: '0644'
  notify: restart keycloak
  tags: keycloak

- name: "✅ Start and enable Keycloak"
  ansible.builtin.systemd:
    name: keycloak
    state: started
    enabled: true
    daemon_reload: true
  tags: keycloak

- name: "⏳ Wait for Keycloak to be ready"
  ansible.builtin.wait_for:
    port: "{{ keycloak.http_port }}"
    host: 127.0.0.1
    timeout: 120
  tags: keycloak

- name: "🌐 Configure Nginx reverse proxy"
  ansible.builtin.import_tasks: nginx.yml
  tags: keycloak

- name: "👑 Create admin user"
  ansible.builtin.command:
    cmd: >
      /opt/keycloak/bin/kcadm.sh config credentials
      --server http://localhost:{{ keycloak.http_port }}
      --realm master
      --user {{ keycloak.admin_user }}
      --password {{ keycloak.admin_password }}
  become: true
  become_user: keycloak
  register: admin_created
  changed_when: false
  failed_when: false
  no_log: true
  tags: keycloak

- name: "🏰 Configure realms and clients"
  ansible.builtin.import_tasks: realms.yml
  tags: keycloak

- name: "🔥 Configure firewall"
  ansible.builtin.import_tasks: firewall.yml
  tags: keycloak

- name: "✅ Keycloak role completed"
  ansible.builtin.debug:
    msg: |
      ✅ Keycloak deployed on {{ inventory_hostname }}
      URL: https://{{ keycloak.hostname }}
      Admin: {{ keycloak.admin_user }}
  tags: keycloak