---
# ============================================================================
# life-church/playbooks/thinkcenter-flatpak.yml
# Ensure Flatpak is installed on thinkcenter, add Flathub, then install
# Flatseal + Bottles. CHANGES the system. thinkcenter ONLY. Idempotent.
#
# - Installs the `flatpak` apt package if not present.
# - Ensures the Flathub remote is configured (system-wide).
# - Installs com.github.tchx84.Flatseal and com.usebottles.bottles from Flathub.
# - become password fetched from Infisical /lc-hosts at runtime.
#
# UNDO: to remove ->
#   flatpak uninstall -y com.usebottles.bottles com.github.tchx84.Flatseal
#   (optionally) apt remove --purge flatpak gnome-software-plugin-flatpak
# ============================================================================

# --- Play 1 (localhost): fetch thinkcenter's sudo password from Infisical ----
- name: "thinkcenter flatpak — resolve become password from Infisical"
  hosts: localhost
  gather_facts: false
  tasks:
    - name: "[resolve] Infisical creds from env"
      ansible.builtin.set_fact:
        infisical_client_id: "{{ lookup('env','INFISICAL_CLIENT_ID') }}"
        infisical_client_secret: "{{ lookup('env','INFISICAL_CLIENT_SECRET') }}"
        infisical_project_id: "{{ lookup('env','INFISICAL_PROJECT_ID') }}"
        infisical_url: "{{ lookup('env','INFISICAL_API_URL') | default('http://192.168.122.41:8080', true) }}"
        infisical_env_slug: "{{ lookup('env','INFISICAL_ENV_SLUG') | default('prod', true) }}"

    - name: "[resolve] Assert Infisical creds present"
      ansible.builtin.assert:
        that:
          - infisical_client_id | length > 0
          - infisical_client_secret | length > 0
          - infisical_project_id | length > 0
        fail_msg: "Infisical creds missing from Semaphore environment 'infisical-dev'."

    - name: "[infisical] Log in"
      infisical.vault.login:
        url: "{{ infisical_url }}"
        auth_method: universal_auth
        universal_auth_client_id: "{{ infisical_client_id }}"
        universal_auth_client_secret: "{{ infisical_client_secret }}"
      register: infisical_login
      no_log: true

    - name: "[infisical] Read /lc-hosts"
      infisical.vault.read_secrets:
        login_data: "{{ infisical_login.login_data }}"
        project_id: "{{ infisical_project_id }}"
        env_slug: "{{ infisical_env_slug }}"
        path: "/lc-hosts"
        as_dict: true
      register: lc_secrets
      no_log: true

    - name: "[set] Stash thinkcenter sudo pass"
      ansible.builtin.set_fact:
        thinkcenter_become_pass: "{{ lc_secrets.secrets['THINKCENTER_SUDO_PASS'] }}"
      no_log: true

# --- Play 2: flatpak + Flathub + apps on thinkcenter ONLY --------------------
- name: "Ensure Flatpak + Flathub + Flatseal + Bottles on thinkcenter"
  hosts: thinkcenter          # thinkcenter only
  gather_facts: true
  become: true
  vars:
    ansible_become_pass: "{{ hostvars['localhost'].thinkcenter_become_pass }}"
    flatpak_apps:
      - com.github.tchx84.Flatseal
      - com.usebottles.bottles
  tasks:
    - name: "[safety] Confirm we are on thinkcenter"
      ansible.builtin.assert:
        that: inventory_hostname == 'thinkcenter'
        fail_msg: "Refusing to run — this play is scoped to thinkcenter only."

    - name: "[flatpak] Is flatpak installed?"
      ansible.builtin.command: which flatpak
      register: flatpak_which
      changed_when: false
      failed_when: false

    - name: "[flatpak] Install flatpak (+ GNOME Software plugin) if missing"
      ansible.builtin.apt:
        name:
          - flatpak
          - gnome-software-plugin-flatpak
        state: present
        update_cache: true
      register: flatpak_install
      until: flatpak_install is succeeded
      retries: 3
      delay: 15
      when: flatpak_which.rc != 0

    - name: "[flatpak] Ensure Flathub remote (system-wide)"
      community.general.flatpak_remote:
        name: flathub
        state: present
        flatpakrepo_url: https://flathub.org/repo/flathub.flatpakrepo
        method: system

    - name: "[flatpak] Install Flatpak apps (Flatseal + Bottles)"
      community.general.flatpak:
        name: "{{ item }}"
        state: present
        remote: flathub
        method: system
      loop: "{{ flatpak_apps }}"
      register: app_install

    - name: "[verify] List installed flatpak app IDs"
      ansible.builtin.command: flatpak list --app --columns=application
      register: flatpak_list
      changed_when: false

    - name: "[verify] Assert both apps present"
      ansible.builtin.assert:
        that:
          - "'com.github.tchx84.Flatseal' in flatpak_list.stdout"
          - "'com.usebottles.bottles' in flatpak_list.stdout"
        fail_msg: "One or both flatpak apps failed to install — see flatpak list output."
        success_msg: "Flatseal + Bottles installed."

    - name: "[report] Flatpak summary"
      ansible.builtin.debug:
        msg:
          - "===== thinkcenter flatpak ====="
          - "flatpak was already present : {{ flatpak_which.rc == 0 }}"
          - "flatpak installed this run   : {{ flatpak_install.changed | default(false) }}"
          - "apps changed this run        : {{ app_install.changed }}"
          - "installed apps: {{ flatpak_list.stdout_lines }}"
          - "NOTE: a fresh flatpak install may need a re-login/reboot before apps appear in the menu."