---
# ============================================================================
# life-church/playbooks/thinkcenter-helvum.yml
# Install Helvum (GTK PipeWire patchbay) on thinkcenter via apt.
# thinkcenter ONLY. Idempotent. Native package (no flatpak).
# become password from Infisical /lc-hosts at runtime.
#
# Helvum is a lightweight visual patchbay for PipeWire — complements qpwgraph
# (installed by thinkcenter-audio). Requires a running PipeWire, which the
# audio playbook provides.
#
# UNDO:  sudo apt remove --purge helvum
# ============================================================================

# --- Play 1 (localhost): fetch thinkcenter sudo pass from Infisical ----------
- name: "thinkcenter Helvum — resolve become password from Infisical"
  hosts: localhost
  gather_facts: false
  tasks:
    - name: "[resolve] Infisical creds from env"
      ansible.builtin.set_fact:
        infisical_client_id: "{{ lookup('env','INFISICAL_CLIENT_ID') }}"
        infisical_client_secret: "{{ lookup('env','INFISICAL_CLIENT_SECRET') }}"
        infisical_project_id: "{{ lookup('env','INFISICAL_PROJECT_ID') }}"
        infisical_url: "{{ lookup('env','INFISICAL_API_URL') | default('http://192.168.122.41:8080', true) }}"
        infisical_env_slug: "{{ lookup('env','INFISICAL_ENV_SLUG') | default('prod', true) }}"

    - name: "[resolve] Assert Infisical creds present"
      ansible.builtin.assert:
        that:
          - infisical_client_id | length > 0
          - infisical_client_secret | length > 0
          - infisical_project_id | length > 0
        fail_msg: "Infisical creds missing from Semaphore environment 'infisical-dev'."

    - name: "[infisical] Log in"
      infisical.vault.login:
        url: "{{ infisical_url }}"
        auth_method: universal_auth
        universal_auth_client_id: "{{ infisical_client_id }}"
        universal_auth_client_secret: "{{ infisical_client_secret }}"
      register: infisical_login
      no_log: true

    - name: "[infisical] Read /lc-hosts"
      infisical.vault.read_secrets:
        login_data: "{{ infisical_login.login_data }}"
        project_id: "{{ infisical_project_id }}"
        env_slug: "{{ infisical_env_slug }}"
        path: "/lc-hosts"
        as_dict: true
      register: lc_secrets
      no_log: true

    - name: "[set] Stash thinkcenter sudo pass"
      ansible.builtin.set_fact:
        thinkcenter_become_pass: "{{ lc_secrets.secrets['THINKCENTER_SUDO_PASS'] }}"
      no_log: true

# --- Play 2: Helvum on thinkcenter ONLY --------------------------------------
- name: "Install Helvum on thinkcenter"
  hosts: thinkcenter
  gather_facts: true
  become: true
  vars:
    ansible_become_pass: "{{ hostvars['localhost'].thinkcenter_become_pass }}"
  tasks:
    - name: "[safety] Confirm we are on thinkcenter"
      ansible.builtin.assert:
        that: inventory_hostname == 'thinkcenter'
        fail_msg: "Refusing to run — this play is scoped to thinkcenter only."

    - name: "[selfheal] Repair any half-configured dpkg/apt state (prevents cascade failures)"
      ansible.builtin.shell: |
        dpkg --configure -a || true
        apt-get -y -f install || true
      register: dpkg_selfheal
      changed_when: "'Setting up' in (dpkg_selfheal.stdout | default(''))"
      failed_when: false

    - name: "[safety] Confirm Ubuntu-family host"
      ansible.builtin.assert:
        that: ansible_facts.os_family == 'Debian'
        fail_msg: "This playbook targets Debian/Ubuntu (Mint). Host is {{ ansible_facts.os_family }}."

    - name: "[apt] Update cache (retry on transient failure)"
      ansible.builtin.apt:
        update_cache: true
        cache_valid_time: 3600
      register: apt_cache
      until: apt_cache is succeeded
      retries: 3
      delay: 15

    - name: "[apt] Install Helvum (retry on dpkg lock)"
      ansible.builtin.apt:
        name: helvum
        state: present
      register: helvum_install
      until: helvum_install is succeeded
      retries: 3
      delay: 15

    - name: "[verify] helvum binary present"
      ansible.builtin.command: which helvum
      register: helvum_which
      changed_when: false
      failed_when: false

    - name: "[verify] Assert Helvum installed"
      ansible.builtin.assert:
        that: helvum_which.rc == 0
        fail_msg: "Helvum binary not found after install."
        success_msg: "Helvum installed at {{ helvum_which.stdout | trim }}."

    - name: "[report] Helvum summary"
      ansible.builtin.debug:
        msg:
          - "===== thinkcenter Helvum ====="
          - "packages changed this run : {{ helvum_install.changed }}"
          - "helvum path               : {{ helvum_which.stdout | default('n/a') | trim }}"
          - "NOTE: Helvum needs a running PipeWire session (see thinkcenter-audio). Launch from the app menu."