# Alliance Boréale - Playbook Phase 2
# Déploiement Identité & Forge (Couches C3-C4)
# Membre: Chezlepro Inc.
# Date: 2025-10-31

---
- name: "🌲 Phase 2 - Préparation VMs (Common)"
  hosts: phase2_servers
  become: true
  gather_facts: true
  
  pre_tasks:
    - name: "🔍 Vérifier connectivité SSH"
      ansible.builtin.ping:
      tags: always
    
    - name: "📋 Afficher informations hôte"
      ansible.builtin.debug:
        msg: |
          Hôte: {{ inventory_hostname }}
          IP: {{ ansible_host }}
          VMID: {{ vmid | default('N/A') }}
      tags: always
  
  roles:
    - role: common
      tags: common
  
  post_tasks:
    - name: "✅ Common terminé"
      ansible.builtin.debug:
        msg: "✅ Hardening complété sur {{ inventory_hostname }}"

# ============================================
- name: "🔑 Phase 2 - Keycloak (IdP)"
  hosts: idp_servers
  become: true
  gather_facts: true
  
  roles:
    - role: postgresql
      tags: postgresql
    
    - role: keycloak
      tags: keycloak
  
  post_tasks:
    - name: "✅ Keycloak terminé"
      ansible.builtin.debug:
        msg: |
          ✅ Keycloak déployé sur {{ inventory_hostname }}
          URL: https://{{ keycloak.hostname }}
          Admin: {{ keycloak.admin_user }}
          
          ⚠️ IMPORTANT: Note client secret for Forgejo
      tags: always

# ============================================
- name: "🔨 Phase 2 - Forgejo (Forge)"
  hosts: forge_servers
  become: true
  gather_facts: true
  
  roles:
    - role: postgresql
      tags: postgresql
    
    - role: forgejo
      tags: forgejo
  
  post_tasks:
    - name: "✅ Forgejo terminé"
      ansible.builtin.debug:
        msg: |
          ✅ Forgejo déployé sur {{ inventory_hostname }}
          URL: https://{{ forgejo.hostname }}
          SSH: git@{{ forgejo.hostname }}:{{ forgejo.ssh_port }}
          Admin: {{ forgejo.admin.username }}
      tags: always

# ============================================
- name: "🧪 Phase 2 - Tests d'intégration"
  hosts: localhost
  gather_facts: false
  
  tasks:
    - name: "🧪 Test Keycloak availability"
      ansible.builtin.uri:
        url: "https://{{ hostvars[groups['idp_servers'][0]]['keycloak']['hostname'] }}/realms/alliance-boreale"
        validate_certs: false
        status_code: 200
      register: keycloak_test
      delegate_to: localhost
      changed_when: false
    
    - name: "✅ Keycloak OK"
      ansible.builtin.debug:
        msg: "✅ Keycloak répond correctement"
      when: keycloak_test.status == 200
    
    - name: "🧪 Test Forgejo availability"
      ansible.builtin.uri:
        url: "https://{{ hostvars[groups['forge_servers'][0]]['forgejo']['hostname'] }}"
        validate_certs: false
        status_code: 200
      register: forgejo_test
      delegate_to: localhost
      changed_when: false
    
    - name: "✅ Forgejo OK"
      ansible.builtin.debug:
        msg: "✅ Forgejo répond correctement"
      when: forgejo_test.status == 200

# ============================================
- name: "📋 Phase 2 - Récapitulatif"
  hosts: localhost
  gather_facts: false
  
  tasks:
    - name: "🎉 Phase 2 terminée avec succès!"
      ansible.builtin.debug:
        msg: |
          
          ═══════════════════════════════════════════════
          🌲 PHASE 2 - IDENTITÉ & FORGE DÉPLOYÉES
          ═══════════════════════════════════════════════
          
          ✅ Services déployés:
          
          🔑 KEYCLOAK (SSO)
             URL: https://{{ hostvars[groups['idp_servers'][0]]['keycloak']['hostname'] }}
             Admin: {{ hostvars[groups['idp_servers'][0]]['keycloak']['admin_user'] }}
             Realm: alliance-boreale
          
          🔨 FORGEJO (Forge Git)
             URL: https://{{ hostvars[groups['forge_servers'][0]]['forgejo']['hostname'] }}
             SSH: git@{{ hostvars[groups['forge_servers'][0]]['forgejo']['hostname'] }}:{{ hostvars[groups['forge_servers'][0]]['forgejo']['ssh_port'] }}
             Admin: {{ hostvars[groups['forge_servers'][0]]['forgejo']['admin_username'] }}
          
          📋 Configuration SSO:
          
          1. Se connecter à Keycloak:
             https://{{ hostvars[groups['idp_servers'][0]]['keycloak']['hostname'] }}
          
          2. Aller dans Realm "alliance-boreale"
          
          3. Clients → "forgejo" → Credentials
             Copier le "Client Secret"
          
          4. Ajouter ce secret dans vault:
             ansible-vault edit vault/production.yml
             vault_keycloak_forgejo_client_secret: "<secret>"
          
          5. Redéployer Forgejo:
             ansible-playbook playbooks/phase2-deploy.yml --tags forgejo
          
          📋 Premiers pas:
          
          1. Créer utilisateurs dans Keycloak
          
          2. Se connecter à Forgejo via SSO
          
          3. Créer organisations/repos:
             - alliance-boreale/ansible-infrastructure
             - alliance-boreale/documentation
             - alliance-boreale/registraire
          
          4. Pousser ce dépôt Ansible vers Forgejo:
             git remote add origin git@{{ hostvars[groups['forge_servers'][0]]['forgejo']['hostname'] }}:{{ hostvars[groups['forge_servers'][0]]['forgejo']['ssh_port'] }}/alliance-boreale/ansible-infrastructure.git
             git push -u origin main
          
          5. Configurer CI/CD (Forgejo Actions)
          
          6. Passer à Phase 3 (FastAPI Pivot)
          
          ═══════════════════════════════════════════════
      tags: always