# Alliance Boréale - Rôle Forgejo
# Couche: C4 (Forge & Mutualisation)
# Objectif: Déployer Forge Git avec SSO Keycloak
# Date: 2025-10-31

---
- name: "📦 Install dependencies"
  ansible.builtin.apt:
    name:
      - git
      - nginx
      - openssl
      - python3-psycopg2
    state: present
    update_cache: true
  tags: forgejo

- name: "👤 Create git user"
  ansible.builtin.user:
    name: "{{ forgejo.user }}"
    system: true
    shell: /bin/bash
    home: "{{ forgejo.data_dir }}"
    create_home: true
  tags: forgejo

- name: "📁 Create forgejo directories"
  ansible.builtin.file:
    path: "{{ item }}"
    state: directory
    owner: "{{ forgejo.user }}"
    group: "{{ forgejo.group }}"
    mode: '0755'
  loop:
    - "{{ forgejo.install_dir }}"
    - "{{ forgejo.custom_dir }}"
    - "{{ forgejo.log_dir }}"
    - "{{ forgejo.data_dir }}/git"
    - "{{ forgejo.data_dir }}/repositories"
  tags: forgejo

- name: "📥 Download Forgejo binary"
  ansible.builtin.get_url:
    url: "https://codeberg.org/forgejo/forgejo/releases/download/v{{ forgejo.version }}/forgejo-{{ forgejo.version }}-linux-amd64"
    dest: "{{ forgejo.install_dir }}/forgejo"
    owner: "{{ forgejo.user }}"
    group: "{{ forgejo.group }}"
    mode: '0755'
  tags: forgejo

- name: "🗄️ Configure PostgreSQL for Forgejo"
  ansible.builtin.import_tasks: database.yml
  tags: forgejo

- name: "⚙️ Configure Forgejo"
  ansible.builtin.template:
    src: app.ini.j2
    dest: "{{ forgejo.custom_dir }}/app.ini"
    owner: "{{ forgejo.user }}"
    group: "{{ forgejo.group }}"
    mode: '0640'
  notify: restart forgejo
  tags: forgejo

- name: "⚙️ Create systemd service"
  ansible.builtin.template:
    src: forgejo.service.j2
    dest: /etc/systemd/system/forgejo.service
    owner: root
    group: root
    mode: '0644'
  notify: restart forgejo
  tags: forgejo

- name: "✅ Start and enable Forgejo"
  ansible.builtin.systemd:
    name: forgejo
    state: started
    enabled: true
    daemon_reload: true
  tags: forgejo

- name: "⏳ Wait for Forgejo to be ready"
  ansible.builtin.wait_for:
    port: "{{ forgejo.http_port }}"
    host: 127.0.0.1
    timeout: 60
  tags: forgejo

- name: "🌐 Configure Nginx reverse proxy"
  ansible.builtin.import_tasks: nginx.yml
  tags: forgejo

- name: "👑 Create admin user"
  ansible.builtin.command:
    cmd: >
      {{ forgejo.install_dir }}/forgejo admin user create
      --username {{ forgejo.admin.username }}
      --password {{ forgejo.admin.password }}
      --email {{ forgejo.admin.email }}
      --admin
      --config {{ forgejo.custom_dir }}/app.ini
    creates: "{{ forgejo.data_dir }}/.admin_created"
  become: true
  become_user: "{{ forgejo.user }}"
  register: admin_created
  no_log: true
  tags: forgejo

- name: "✅ Mark admin as created"
  ansible.builtin.file:
    path: "{{ forgejo.data_dir }}/.admin_created"
    state: touch
    owner: "{{ forgejo.user }}"
    group: "{{ forgejo.group }}"
    mode: '0644'
  when: admin_created.changed
  tags: forgejo

- name: "🔥 Configure firewall"
  ansible.builtin.import_tasks: firewall.yml
  tags: forgejo

- name: "✅ Forgejo role completed"
  ansible.builtin.debug:
    msg: |
      ✅ Forgejo deployed on {{ inventory_hostname }}
      URL: https://{{ forgejo.hostname }}
      SSH: git@{{ forgejo.hostname }}:{{ forgejo.ssh_port }}
      Admin: {{ forgejo.admin.username }}
  tags: forgejo