---
# ============================================================================
# deploy-homarr.yml — deploy Homarr dashboard as the `ansible` user
# ============================================================================
# Prereq: host has been bootstrapped (see bootstrap.yml) so the `ansible`
# user exists with the SSH key installed. This playbook connects AS ansible,
# creates ~/docker/homarr/, drops the compose file, and brings it up.
#
# Secret from Infisical (Semaphore env injection):
#   HOMARR_SECRET_ENCRYPTION_KEY - 64-char hex (openssl rand -hex 32)
#
# Usage (Semaphore Task Template):
#   playbook: playbooks/deploy-homarr.yml
#   inventory: inventory/hosts.yml
#   limit: racknerd1
# ============================================================================

- name: Deploy Homarr (as ansible user)
  hosts: "{{ target | default('racknerd1') }}"
  become: true                       # sudo for docker
  gather_facts: true
  vars:
    deploy_user: ansible
    homarr_dir: "/home/{{ deploy_user }}/docker/homarr"
    homarr_port: 7575
    homarr_image: ghcr.io/homarr-labs/homarr:latest
    homarr_encryption_key: "{{ lookup('env', 'HOMARR_SECRET_ENCRYPTION_KEY') }}"

  tasks:
    - name: Validate encryption key present (64-hex)
      ansible.builtin.assert:
        that:
          - homarr_encryption_key | length == 64
        fail_msg: "HOMARR_SECRET_ENCRYPTION_KEY must be 64 hex chars (from Infisical)."

    - name: Confirm Docker is available
      ansible.builtin.command: docker version
      register: dv
      changed_when: false
      failed_when: dv.rc != 0

    - name: Create ~/docker/homarr directory tree (owned by {{ deploy_user }})
      ansible.builtin.file:
        path: "{{ item }}"
        state: directory
        owner: "{{ deploy_user }}"
        group: "{{ deploy_user }}"
        mode: "0755"
      loop:
        - "/home/{{ deploy_user }}/docker"
        - "{{ homarr_dir }}"
        - "{{ homarr_dir }}/appdata"

    - name: Write docker-compose.yml
      ansible.builtin.copy:
        dest: "{{ homarr_dir }}/docker-compose.yml"
        owner: "{{ deploy_user }}"
        group: "{{ deploy_user }}"
        mode: "0644"
        content: |
          services:
            homarr:
              container_name: homarr
              image: {{ homarr_image }}
              restart: unless-stopped
              volumes:
                - /var/run/docker.sock:/var/run/docker.sock
                - {{ homarr_dir }}/appdata:/appdata
              environment:
                - SECRET_ENCRYPTION_KEY={{ homarr_encryption_key }}
              ports:
                - "{{ homarr_port }}:7575"

    - name: Pull and start Homarr
      community.docker.docker_compose_v2:
        project_src: "{{ homarr_dir }}"
        pull: always
        state: present
      register: compose_up

    - name: Wait for Homarr to respond
      ansible.builtin.uri:
        url: "http://127.0.0.1:{{ homarr_port }}/"
        status_code: [200, 302, 307]
      register: health
      retries: 15
      delay: 5
      until: health.status is defined and health.status in [200, 302, 307]

    - name: Result
      ansible.builtin.debug:
        msg: "Homarr up on {{ inventory_hostname }}:{{ homarr_port }} (HTTP {{ health.status }})"