---
- name: Installer Groupe Meditation
  hosts: groupe_meditation
  become: true
  gather_facts: true

  pre_tasks:
    - name: Charger les secrets locaux si presents
      ansible.builtin.include_vars:
        file: "{{ playbook_dir }}/group_vars/vault.yml"
      when: lookup('ansible.builtin.fileglob', playbook_dir + '/group_vars/vault.yml') | length > 0
      no_log: true

    - name: Valider Debian
      ansible.builtin.assert:
        that:
          - ansible_facts.os_family == "Debian"
        fail_msg: "Ce playbook cible Debian."

    - name: Valider les secrets obligatoires
      ansible.builtin.assert:
        that:
          - groupe_meditation_db_password != "CHANGE_ME_DB_PASSWORD"
          - groupe_meditation_jwt_secret != "CHANGE_ME_JWT_SECRET"
          - groupe_meditation_first_member.prenom != "CHANGE_ME"
          - groupe_meditation_first_member.courriel != "CHANGE_ME@example.com"
          - groupe_meditation_first_member.telephone != "CHANGE_ME"
          - groupe_meditation_first_member.pin is match('^[0-9]{4}$')
        fail_msg: "Renseignez les variables sensibles, idealement dans ansible/group_vars/vault.yml chiffre."

  roles:
    - common
    - postgresql
    - app
    - nginx
    - backup
    - role: certbot
      when: groupe_meditation_enable_tls | bool