From 45e23be8c6e9c381ce4bcee0111dffcab64d3dde Mon Sep 17 00:00:00 2001
From: Samuel James <samueljamesinc@gmail.com>
Date: Thu, 3 Sep 2026 12:17:24 +0000
Subject: [PATCH] life-church: add playbooks/thinkcenter-flatpak.yml
 (thinkcenter-only)

---
 life-church/playbooks/thinkcenter-flatpak.yml | 131 ++++++++++++++++++
 1 file changed, 131 insertions(+)
 create mode 100644 life-church/playbooks/thinkcenter-flatpak.yml

diff --git a/life-church/playbooks/thinkcenter-flatpak.yml b/life-church/playbooks/thinkcenter-flatpak.yml
new file mode 100644
index 0000000..8e4d2dd
--- /dev/null
+++ b/life-church/playbooks/thinkcenter-flatpak.yml
@@ -0,0 +1,131 @@
+---
+# ============================================================================
+# life-church/playbooks/thinkcenter-flatpak.yml
+# Ensure Flatpak is installed on thinkcenter, add Flathub, then install
+# Flatseal + Bottles. CHANGES the system. thinkcenter ONLY. Idempotent.
+#
+# - Installs the `flatpak` apt package if not present.
+# - Ensures the Flathub remote is configured (system-wide).
+# - Installs com.github.tchx84.Flatseal and com.usebottles.bottles from Flathub.
+# - become password fetched from Infisical /lc-hosts at runtime.
+#
+# UNDO: to remove ->
+#   flatpak uninstall -y com.usebottles.bottles com.github.tchx84.Flatseal
+#   (optionally) apt remove --purge flatpak gnome-software-plugin-flatpak
+# ============================================================================
+
+# --- Play 1 (localhost): fetch thinkcenter's sudo password from Infisical ----
+- name: "thinkcenter flatpak — resolve become password from Infisical"
+  hosts: localhost
+  gather_facts: false
+  tasks:
+    - name: "[resolve] Infisical creds from env"
+      ansible.builtin.set_fact:
+        infisical_client_id: "{{ lookup('env','INFISICAL_CLIENT_ID') }}"
+        infisical_client_secret: "{{ lookup('env','INFISICAL_CLIENT_SECRET') }}"
+        infisical_project_id: "{{ lookup('env','INFISICAL_PROJECT_ID') }}"
+        infisical_url: "{{ lookup('env','INFISICAL_API_URL') | default('http://192.168.122.41:8080', true) }}"
+        infisical_env_slug: "{{ lookup('env','INFISICAL_ENV_SLUG') | default('prod', true) }}"
+
+    - name: "[resolve] Assert Infisical creds present"
+      ansible.builtin.assert:
+        that:
+          - infisical_client_id | length > 0
+          - infisical_client_secret | length > 0
+          - infisical_project_id | length > 0
+        fail_msg: "Infisical creds missing from Semaphore environment 'infisical-dev'."
+
+    - name: "[infisical] Log in"
+      infisical.vault.login:
+        url: "{{ infisical_url }}"
+        auth_method: universal_auth
+        universal_auth_client_id: "{{ infisical_client_id }}"
+        universal_auth_client_secret: "{{ infisical_client_secret }}"
+      register: infisical_login
+      no_log: true
+
+    - name: "[infisical] Read /lc-hosts"
+      infisical.vault.read_secrets:
+        login_data: "{{ infisical_login.login_data }}"
+        project_id: "{{ infisical_project_id }}"
+        env_slug: "{{ infisical_env_slug }}"
+        path: "/lc-hosts"
+        as_dict: true
+      register: lc_secrets
+      no_log: true
+
+    - name: "[set] Stash thinkcenter sudo pass"
+      ansible.builtin.set_fact:
+        thinkcenter_become_pass: "{{ lc_secrets.secrets['THINKCENTER_SUDO_PASS'] }}"
+      no_log: true
+
+# --- Play 2: flatpak + Flathub + apps on thinkcenter ONLY --------------------
+- name: "Ensure Flatpak + Flathub + Flatseal + Bottles on thinkcenter"
+  hosts: thinkcenter          # thinkcenter only
+  gather_facts: true
+  become: true
+  vars:
+    ansible_become_pass: "{{ hostvars['localhost'].thinkcenter_become_pass }}"
+    flatpak_apps:
+      - com.github.tchx84.Flatseal
+      - com.usebottles.bottles
+  tasks:
+    - name: "[safety] Confirm we are on thinkcenter"
+      ansible.builtin.assert:
+        that: inventory_hostname == 'thinkcenter'
+        fail_msg: "Refusing to run — this play is scoped to thinkcenter only."
+
+    - name: "[flatpak] Is flatpak installed?"
+      ansible.builtin.command: which flatpak
+      register: flatpak_which
+      changed_when: false
+      failed_when: false
+
+    - name: "[flatpak] Install flatpak (+ GNOME Software plugin) if missing"
+      ansible.builtin.apt:
+        name:
+          - flatpak
+          - gnome-software-plugin-flatpak
+        state: present
+        update_cache: true
+      when: flatpak_which.rc != 0
+      register: flatpak_install
+
+    - name: "[flatpak] Ensure Flathub remote (system-wide)"
+      community.general.flatpak_remote:
+        name: flathub
+        state: present
+        flatpakrepo_url: https://flathub.org/repo/flathub.flatpakrepo
+        method: system
+
+    - name: "[flatpak] Install Flatpak apps (Flatseal + Bottles)"
+      community.general.flatpak:
+        name: "{{ item }}"
+        state: present
+        remote: flathub
+        method: system
+      loop: "{{ flatpak_apps }}"
+      register: app_install
+
+    - name: "[verify] List installed flatpak app IDs"
+      ansible.builtin.command: flatpak list --app --columns=application
+      register: flatpak_list
+      changed_when: false
+
+    - name: "[verify] Assert both apps present"
+      ansible.builtin.assert:
+        that:
+          - "'com.github.tchx84.Flatseal' in flatpak_list.stdout"
+          - "'com.usebottles.bottles' in flatpak_list.stdout"
+        fail_msg: "One or both flatpak apps failed to install — see flatpak list output."
+        success_msg: "Flatseal + Bottles installed."
+
+    - name: "[report] Flatpak summary"
+      ansible.builtin.debug:
+        msg:
+          - "===== thinkcenter flatpak ====="
+          - "flatpak was already present : {{ flatpak_which.rc == 0 }}"
+          - "flatpak installed this run   : {{ flatpak_install.changed | default(false) }}"
+          - "apps changed this run        : {{ app_install.changed }}"
+          - "installed apps: {{ flatpak_list.stdout_lines }}"
+          - "NOTE: a fresh flatpak install may need a re-login/reboot before apps appear in the menu."