# Alliance Boréale - Forgejo Tasks (database, nginx, firewall)
# Date: 2025-10-31

---
# ==========================================
# DATABASE.YML
# ==========================================
- name: "🗄️ Ensure PostgreSQL is installed"
  ansible.builtin.include_role:
    name: postgresql
  when: "'postgresql_servers' in group_names"

- name: "🗄️ Create Forgejo database"
  community.postgresql.postgresql_db:
    name: "{{ forgejo.db.name }}"
    encoding: UTF8
    state: present
  become: true
  become_user: postgres

- name: "👤 Create Forgejo database user"
  community.postgresql.postgresql_user:
    name: "{{ forgejo.db.user }}"
    password: "{{ forgejo.db.password }}"
    state: present
  become: true
  become_user: postgres
  no_log: true

- name: "🔐 Grant privileges to Forgejo user"
  community.postgresql.postgresql_privs:
    database: "{{ forgejo.db.name }}"
    roles: "{{ forgejo.db.user }}"
    type: database
    privs: ALL
    state: present
  become: true
  become_user: postgres

# ==========================================
# NGINX.YML
# ==========================================
- name: "📦 Ensure Nginx is installed"
  ansible.builtin.apt:
    name: nginx
    state: present

- name: "🔐 Generate self-signed SSL certificate"
  ansible.builtin.command:
    cmd: >
      openssl req -x509 -nodes -days 365 -newkey rsa:2048
      -keyout /etc/ssl/private/{{ forgejo.hostname }}.key
      -out /etc/ssl/certs/{{ forgejo.hostname }}.crt
      -subj "/C=CA/ST=Quebec/L=Montreal/O=Chezlepro/CN={{ forgejo.hostname }}"
    creates: "/etc/ssl/certs/{{ forgejo.hostname }}.crt"
  when: nginx.ssl.cert_source == 'self-signed'

- name: "⚙️ Configure Nginx for Forgejo"
  ansible.builtin.template:
    src: nginx-forgejo.conf.j2
    dest: /etc/nginx/sites-available/forgejo
    owner: root
    group: root
    mode: '0644'
  notify: reload nginx

- name: "🔗 Enable Nginx site"
  ansible.builtin.file:
    src: /etc/nginx/sites-available/forgejo
    dest: /etc/nginx/sites-enabled/forgejo
    state: link
  notify: reload nginx

- name: "✅ Start and enable Nginx"
  ansible.builtin.systemd:
    name: nginx
    state: started
    enabled: true

# ==========================================
# FIREWALL.YML
# ==========================================
- name: "🔥 Configure firewall for Forgejo"
  ansible.builtin.blockinfile:
    path: /etc/nftables.conf
    marker: "# {mark} ANSIBLE MANAGED - Forgejo"
    insertbefore: "# Log dropped packets"
    block: |
      # Forgejo - Internal HTTP (backend only)
      ip saddr 127.0.0.1 tcp dport {{ forgejo.http_port }} accept comment "Forgejo HTTP"
      
      # Forgejo - SSH (Git over SSH)
      tcp dport {{ forgejo.ssh_port }} accept comment "Forgejo SSH"
      
      # Nginx - HTTPS (public)
      tcp dport 443 accept comment "HTTPS (Forgejo via Nginx)"
      tcp dport 80 accept comment "HTTP redirect"
  notify: reload nftables