---
- name: Deploy PDS
  hosts: pds
  become: yes
  vars_files:
    - vars/main.yml
  vars:
    pds_data_dir: /pds
    pds_image_tag: "0.4"
    pds_blob_upload_limit: 104857600
    pds_rate_limits_enabled: true
    pds_invite_required: true
    pds_backup_period: 24h
    pds_backup_s3_bucket: atprotopds-backup
    pds_backup_s3_region: bhs
    pds_backup_s3_endpoint: https://s3.bhs.io.cloud.ovh.net
    pds_backup_s3_access_key: "{{ pds_blobstore_s3_access_key }}"
    pds_backup_s3_secret_key: "{{ pds_blobstore_s3_secret_key }}"

  tasks:
    - name: Run PDS installer (first time only)
      shell: >-
        echo "n" | bash <(curl -fsSL
        https://raw.githubusercontent.com/bluesky-social/pds/main/installer.sh)
        {{ pds_data_dir }} {{ pds_hostname }} {{ pds_admin_email }}
      args:
        creates: "{{ pds_data_dir }}/account.sqlite"
        executable: /bin/bash

    - name: Read existing secrets from pds.env
      shell: grep -E '^(PDS_JWT_SECRET|PDS_ADMIN_PASSWORD|PDS_PLC_ROTATION_KEY_K256_PRIVATE_KEY_HEX)=' {{ pds_data_dir }}/pds.env
      register: existing_secrets
      changed_when: false

    - name: Set secret facts
      set_fact:
        pds_jwt_secret: "{{ existing_secrets.stdout_lines | select('match', '^PDS_JWT_SECRET=') | first | regex_replace('^PDS_JWT_SECRET=', '') }}"
        pds_admin_password: "{{ existing_secrets.stdout_lines | select('match', '^PDS_ADMIN_PASSWORD=') | first | regex_replace('^PDS_ADMIN_PASSWORD=', '') }}"
        pds_plc_rotation_key: "{{ existing_secrets.stdout_lines | select('match', '^PDS_PLC_ROTATION_KEY_K256_PRIVATE_KEY_HEX=') | first | regex_replace('^PDS_PLC_ROTATION_KEY_K256_PRIVATE_KEY_HEX=', '') }}"

    - name: Install rclone
      apt:
        name: rclone
        state: present
        update_cache: yes

    - name: Create rclone config directory
      file:
        path: /etc/rclone
        state: directory
        mode: "0755"

    - name: Deploy rclone config
      template:
        src: templates/rclone.conf.j2
        dest: /etc/rclone/rclone.conf
        mode: "0600"
      notify: apply changes

    - name: Deploy backup script
      template:
        src: templates/backup.sh.j2
        dest: /usr/local/bin/backup.sh
        mode: "0755"
      notify: apply changes

    - name: Deploy backup service
      template:
        src: templates/backup.service.j2
        dest: /etc/systemd/system/pds-backup.service
        mode: "0644"

    - name: Deploy backup timer
      template:
        src: templates/backup.timer.j2
        dest: /etc/systemd/system/pds-backup.timer
        mode: "0644"

    - name: Enable backup timer
      systemd:
        name: pds-backup.timer
        enabled: yes
        state: started
        daemon_reload: yes

    - name: Pre-deploy backup
      shell: /usr/local/bin/backup.sh predeploy
      when: existing_secrets.stdout_lines | length > 0

    - name: Deploy pds.env
      template:
        src: templates/pds.env.j2
        dest: "{{ pds_data_dir }}/pds.env"
        mode: "0600"
      notify: apply changes

    - name: Deploy compose.yaml
      template:
        src: templates/compose.yaml.j2
        dest: "{{ pds_data_dir }}/compose.yaml"
        mode: "0644"
      notify: apply changes

    - name: Deploy Caddyfile
      template:
        src: templates/Caddyfile.j2
        dest: "{{ pds_data_dir }}/caddy/etc/caddy/Caddyfile"
        mode: "0644"
      notify: apply changes

    - name: Download pdsadmin
      get_url:
        url: https://raw.githubusercontent.com/bluesky-social/pds/main/pdsadmin.sh
        dest: /usr/local/bin/pdsadmin
        mode: "0755"

  handlers:
    - name: apply changes
      shell: cd {{ pds_data_dir }} && docker compose up -d && docker restart caddy