---
- name: Exiger le mot de passe admin Grafana (Vault)
  ansible.builtin.assert:
    that:
      - serveurs_grafana_admin_password | length > 0
    fail_msg: "serveurs_grafana_admin_password est requis (Ansible Vault)."

- name: Assurer le repertoire des trousseaux apt
  ansible.builtin.file:
    path: /etc/apt/keyrings
    state: directory
    owner: root
    group: root
    mode: "0755"

- name: Telecharger la cle de signature Grafana
  ansible.builtin.get_url:
    url: "{{ serveurs_grafana_depot_cle_url }}"
    dest: "{{ serveurs_grafana_depot_cle_fichier }}"
    owner: root
    group: root
    mode: "0644"

- name: Ajouter le depot apt Grafana
  ansible.builtin.apt_repository:
    repo: "{{ serveurs_grafana_depot_source }}"
    filename: grafana
    state: present

- name: Installer Grafana
  ansible.builtin.apt:
    name: "{{ serveurs_grafana_paquets }}"
    state: present
    update_cache: true

- name: Provisionner les datasources (Prometheus + Loki)
  ansible.builtin.template:
    src: datasources.yaml.j2
    dest: /etc/grafana/provisioning/datasources/chezlepro.yaml
    owner: root
    group: grafana
    mode: "0640"
  notify: Redemarrer grafana

- name: Assurer le repertoire de drop-in systemd
  ansible.builtin.file:
    path: /etc/systemd/system/grafana-server.service.d
    state: directory
    owner: root
    group: root
    mode: "0755"

- name: Deployer la configuration d'environnement (domaine + secret)
  ansible.builtin.template:
    src: chezlepro.conf.j2
    dest: /etc/systemd/system/grafana-server.service.d/chezlepro.conf
    owner: root
    group: root
    mode: "0600"
  no_log: true
  notify: Redemarrer grafana

- name: Activer et demarrer Grafana
  ansible.builtin.systemd:
    name: "{{ serveurs_grafana_service }}"
    enabled: true
    state: started
    daemon_reload: true