---
- name: Assert letsencrypt_email is set
  ansible.builtin.assert:
    that:
      - letsencrypt_email is defined
      - (letsencrypt_email | trim) | length > 0
    fail_msg: "Définis letsencrypt_email (ex: ops@chezlepro.ca) dans group_vars/all.yml"

- name: Ensure working directory exists for bbb-install
  ansible.builtin.file:
    path: "{{ bbb_install_script_path | dirname }}"
    state: directory
    owner: root
    group: root
    mode: "0700"

# NOTE: bbb-install / bbb-conf s'appuie parfois sur des helpers UFW. On installe le paquet
# mais on ne l'active pas. Le firewall effectif reste nftables (hostfilter).
- name: Install ufw package (kept disabled)
  ansible.builtin.apt:
    name: ufw
    state: present
    update_cache: true

- name: Ensure ufw service is disabled (nftables is authoritative)
  ansible.builtin.systemd:
    name: ufw
    enabled: false
    state: stopped
  failed_when: false

- name: Download bbb-install.sh (BBB 3.0.x)
  ansible.builtin.get_url:
    url: "{{ bbb_install_script_url }}"
    dest: "{{ bbb_install_script_path }}"
    mode: "0755"
    owner: root
    group: root

- name: Detect if BBB is already installed
  ansible.builtin.stat:
    path: /usr/bin/bbb-conf
  register: bbb_conf_bin

- name: Run bbb-install.sh (BBB 3.x + built-in TURN/haproxy)
  ansible.builtin.command: >
    {{ bbb_install_script_path }}
    -v {{ bbb_version }}
    -s {{ fqdn }}
    -e {{ letsencrypt_email }}
    {% if bbb_skip_min_requirements | bool %}-j{% endif %}
    {% if bbb_install_greenlight | bool %}-g{% endif %}
  register: bbb_install_run
  changed_when: true
  when: bbb_install_force | bool or not bbb_conf_bin.stat.exists

# --- Post-install: align coturn relay UDP range with our nftables policy ---
- name: Ensure /etc/turnserver.conf exists (installed by bbb-install)
  ansible.builtin.stat:
    path: /etc/turnserver.conf
  register: turn_conf

- name: Set coturn min-port (relay UDP) to match firewall
  ansible.builtin.lineinfile:
    path: /etc/turnserver.conf
    regexp: '^min-port='
    line: "min-port={{ turn_relay_udp_min }}"
    backrefs: false
  when: turn_conf.stat.exists and turn_enabled | bool
  notify: restart coturn

- name: Set coturn max-port (relay UDP) to match firewall
  ansible.builtin.lineinfile:
    path: /etc/turnserver.conf
    regexp: '^max-port='
    line: "max-port={{ turn_relay_udp_max }}"
    backrefs: false
  when: turn_conf.stat.exists and turn_enabled | bool
  notify: restart coturn

- name: Ensure coturn listens on standard ports (3478 + 443) - doc check
  ansible.builtin.assert:
    that:
      - turn_listen_port | int == 3478
      - turn_tls_port | int == 443
    fail_msg: "Pour la compatibilité BBB, on recommande turn_listen_port=3478 et turn_tls_port=443 (TURN sur 443 via HAProxy)."
  when: turn_enabled | bool

# --- Verify ---
- name: Run bbb-conf --check
  ansible.builtin.command: bbb-conf --check
  register: bbb_check
  changed_when: false

- name: Show bbb-conf --check (first 200 lines)
  ansible.builtin.debug:
    msg: "{{ (bbb_check.stdout_lines | default([]))[:200] }}"