---
- name: Refuser le nettoyage sans confirmation explicite
  ansible.builtin.assert:
    that:
      - template_cleanup_confirm | bool
    fail_msg: "Nettoyage refusé. Relancer avec -e template_cleanup_confirm=true"

- name: Nettoyer cloud-init
  ansible.builtin.command: cloud-init clean --logs
  changed_when: true

- name: Nettoyer le cache APT
  ansible.builtin.apt:
    clean: true

- name: Supprimer les paquets devenus inutiles
  ansible.builtin.apt:
    autoremove: true

- name: Rotation des journaux systemd
  ansible.builtin.command: journalctl --rotate
  changed_when: true
  failed_when: false

- name: Vider les anciens journaux systemd
  ansible.builtin.command: journalctl --vacuum-time=1s
  changed_when: true
  failed_when: false

- name: Vider /etc/machine-id
  ansible.builtin.copy:
    dest: /etc/machine-id
    content: ""
    owner: root
    group: root
    mode: "0444"

- name: Supprimer l'ancien machine-id D-Bus
  ansible.builtin.file:
    path: /var/lib/dbus/machine-id
    state: absent

- name: Recréer le lien D-Bus vers /etc/machine-id
  ansible.builtin.file:
    src: /etc/machine-id
    dest: /var/lib/dbus/machine-id
    state: link
    force: true

- name: Supprimer les historiques shell
  ansible.builtin.file:
    path: "{{ item }}"
    state: absent
  loop:
    - /root/.bash_history
    - "/home/{{ template_cleanup_admin_user }}/.bash_history"
  failed_when: false

- name: Message final
  ansible.builtin.debug:
    msg:
      - "Nettoyage final terminé."
      - "Éteindre la VM puis convertir en template Proxmox."