---
- name: Exiger le mot de passe admin Keycloak (Vault)
  ansible.builtin.assert:
    that:
      - serveurs_keycloak_admin_password | length > 0
    fail_msg: "serveurs_keycloak_admin_password est requis (Ansible Vault)."

- name: Charger le registre des bases applicatives
  ansible.builtin.include_vars:
    file: "{{ role_path }}/../../docs/bases-donnees.yml"

- name: Resoudre l'entree de base de donnees Keycloak
  ansible.builtin.set_fact:
    serveurs_keycloak_entree: "{{ (bases_donnees | default({}))[serveurs_keycloak_db_cle] | default({}) }}"

- name: Exiger une entree de registre et son secret
  ansible.builtin.assert:
    that:
      - serveurs_keycloak_entree.base is defined
      - serveurs_keycloak_entree.proprietaire is defined
      - serveurs_keycloak_entree.secret is defined
    fail_msg: "Entree '{{ serveurs_keycloak_db_cle }}' absente de docs/bases-donnees.yml."

- name: Resoudre le mot de passe de base de donnees (Vault)
  ansible.builtin.set_fact:
    serveurs_keycloak_db_password: "{{ lookup('vars', serveurs_keycloak_entree.secret) }}"
  no_log: true

- name: Installer le JRE
  ansible.builtin.apt:
    name: "{{ serveurs_keycloak_java_paquet }}"
    state: present
    update_cache: true
    cache_valid_time: 3600

- name: Creer l'utilisateur systeme keycloak
  ansible.builtin.user:
    name: "{{ serveurs_keycloak_utilisateur }}"
    system: true
    home: "{{ serveurs_keycloak_home }}"
    create_home: false
    shell: /usr/sbin/nologin

- name: Creer le repertoire d'installation
  ansible.builtin.file:
    path: "{{ serveurs_keycloak_home }}"
    state: directory
    owner: "{{ serveurs_keycloak_utilisateur }}"
    group: "{{ serveurs_keycloak_utilisateur }}"
    mode: "0750"

- name: Telecharger la distribution Keycloak
  ansible.builtin.get_url:
    url: "{{ serveurs_keycloak_url }}"
    dest: "/tmp/keycloak-{{ serveurs_keycloak_version }}.tar.gz"
    mode: "0644"

- name: Extraire Keycloak
  ansible.builtin.unarchive:
    src: "/tmp/keycloak-{{ serveurs_keycloak_version }}.tar.gz"
    dest: "{{ serveurs_keycloak_home }}"
    remote_src: true
    extra_opts: ["--strip-components=1"]
    owner: "{{ serveurs_keycloak_utilisateur }}"
    group: "{{ serveurs_keycloak_utilisateur }}"
    creates: "{{ serveurs_keycloak_home }}/bin/kc.sh"

- name: Deployer keycloak.conf (config non sensible)
  ansible.builtin.template:
    src: keycloak.conf.j2
    dest: "{{ serveurs_keycloak_home }}/conf/keycloak.conf"
    owner: "{{ serveurs_keycloak_utilisateur }}"
    group: "{{ serveurs_keycloak_utilisateur }}"
    mode: "0640"
  notify: Redemarrer keycloak

- name: Creer le repertoire de configuration des secrets
  ansible.builtin.file:
    path: /etc/keycloak
    state: directory
    owner: root
    group: "{{ serveurs_keycloak_utilisateur }}"
    mode: "0750"

- name: Deployer le fichier d'environnement (secrets)
  ansible.builtin.template:
    src: keycloak.env.j2
    dest: /etc/keycloak/keycloak.env
    owner: root
    group: "{{ serveurs_keycloak_utilisateur }}"
    mode: "0640"
  no_log: true
  notify: Redemarrer keycloak

- name: Construire Keycloak (une fois par version)
  ansible.builtin.shell:
    cmd: >-
      {{ serveurs_keycloak_home }}/bin/kc.sh build --db=postgres
      && touch {{ serveurs_keycloak_home }}/.kc-built-{{ serveurs_keycloak_version }}
    creates: "{{ serveurs_keycloak_home }}/.kc-built-{{ serveurs_keycloak_version }}"
  become: true
  become_user: "{{ serveurs_keycloak_utilisateur }}"
  notify: Redemarrer keycloak

- name: Deployer l'unite systemd keycloak
  ansible.builtin.template:
    src: keycloak.service.j2
    dest: /etc/systemd/system/keycloak.service
    owner: root
    group: root
    mode: "0644"
  notify: Redemarrer keycloak

- name: Activer et demarrer keycloak
  ansible.builtin.systemd:
    name: "{{ serveurs_keycloak_service }}"
    enabled: true
    state: started
    daemon_reload: true