---
# Provision the sa-wellness PRODUCTION LXC (Gate 3, Semaphore-run, one-time).
# Additions-only to sam/semaphore.git /playbook. Semaphore provisions PROD (not dev/staging).
# After this runs once, playbook/deploy-sa-wellness.yml deploys/rolls versioned images into it.
#
# Optional extra-vars:
#   node:   proxmox node to create the LXC on (default pve4)
#   vmid:   prod VMID (default 130 — 1xx range; pick the lowest free if taken)
#   ip:     static CIDR (default 192.168.122.130/24)
#
# Run:  -e "vmid=130 ip=192.168.122.130/24"

- name: Provision sa-wellness-prod LXC
  hosts: "{{ node | default('pve4') }}"
  gather_facts: false
  vars:
    vmid: "{{ vmid | default('130') }}"
    ctip: "{{ ip | default('192.168.122.130/24') }}"
    ctname: "sa-wellness-prod"
    template: "local:vztmpl/debian-12-standard_12.12-1_amd64.tar.zst"
  tasks:
    - name: Create the prod LXC if absent (nesting for docker, onboot, tagged)
      ansible.builtin.shell: |
        set -e
        if [ -n "$(pct list | awk '$0 ~ /{{ ctname }}/ {print $1}')" ]; then
          echo "exists"; exit 0
        fi
        pct create {{ vmid }} {{ template }} \
          --hostname {{ ctname }} \
          --cores 2 --memory 2048 --swap 512 \
          --rootfs local-lvm:16 \
          --net0 name=eth0,bridge=vmbr0,ip={{ ctip }},gw=192.168.122.1,type=veth \
          --nameserver 192.168.122.1 \
          --features nesting=1,keyctl=1 --unprivileged 1 \
          --onboot 1 --tags 'sa-wellness;production;docker;api' --start 1
        sleep 8
      register: create_out
      changed_when: "'exists' not in create_out.stdout"

    - name: Install docker inside the prod LXC (idempotent)
      ansible.builtin.shell: |
        pct exec {{ vmid }} -- bash -lc '
          command -v docker >/dev/null 2>&1 && exit 0
          export DEBIAN_FRONTEND=noninteractive
          apt-get update -qq && apt-get install -y -qq ca-certificates curl gnupg
          install -m0755 -d /etc/apt/keyrings
          curl -fsSL https://download.docker.com/linux/debian/gpg | gpg --dearmor -o /etc/apt/keyrings/docker.gpg
          chmod a+r /etc/apt/keyrings/docker.gpg
          . /etc/os-release
          echo "deb [arch=amd64 signed-by=/etc/apt/keyrings/docker.gpg] https://download.docker.com/linux/debian $VERSION_CODENAME stable" > /etc/apt/sources.list.d/docker.list
          apt-get update -qq && apt-get install -y -qq docker-ce docker-ce-cli containerd.io docker-compose-plugin
          mkdir -p /etc/docker
          echo "{\"insecure-registries\":[\"192.168.122.103:3000\"]}" > /etc/docker/daemon.json
          systemctl restart docker'
      changed_when: false

    - name: Report
      ansible.builtin.debug:
        msg: "Provisioned {{ ctname }} (VMID {{ vmid }}, {{ ctip }}). Next: run deploy-sa-wellness.yml -e version=vX.Y.Z"