- name: make caddy directories
  ansible.builtin.file:
    path: "{{ item}}"
    state: directory
  loop:
    - /opt/stacks/caddy

- name: Install apache2-utils for htpasswd
  ansible.builtin.apt:
    name: apache2-utils
    state: present
    update_cache: true
    cache_valid_time: 3600
  become: true
  when: vault_dir2opds is defined

# bcrypt uses a random salt, so a fresh hash would change the Caddyfile (and
# restart Caddy) on every run. Reuse the deployed hash while it still matches
# the vault password; only make a new one when it doesn't.
- name: Get bcrypt hash for dir2opds basic auth
  ansible.builtin.shell: |
    set -eu
    cur=$(awk -v u="$AUTH_USER" '/basic_?auth/ {b=1} b && $1 == u {print $2; exit}' \
          /opt/stacks/caddy/Caddyfile 2>/dev/null || true)
    if [ -n "$cur" ]; then
      tmp=$(mktemp); trap 'rm -f "$tmp"' EXIT
      printf '%s:%s\n' "$AUTH_USER" "$cur" > "$tmp"
      if htpasswd -vb "$tmp" "$AUTH_USER" "$AUTH_PASS" >/dev/null 2>&1; then
        echo "$AUTH_USER $cur"
        exit 0
      fi
    fi
    htpasswd -bnB "$AUTH_USER" "$AUTH_PASS" | awk -F: 'NF {print $1, $2}'
  environment:
    AUTH_USER: "{{ vault_dir2opds.basic_auth_user }}"
    AUTH_PASS: "{{ vault_dir2opds.basic_auth_password }}"
  register: dir2opds_basic_auth_hash_result
  changed_when: false
  check_mode: false
  no_log: true
  when: vault_dir2opds is defined

- name: template Caddyfile
  ansible.builtin.template:
    src: Caddyfile.j2
    dest: /opt/stacks/caddy/Caddyfile
    owner: root
    mode: '0640'
    group: docker
  notify: restart caddy

- name: template caddy compose file
  ansible.builtin.template:
    src: caddy-compose.yml.j2
    dest: /opt/stacks/caddy/compose.yml
    owner: root
    mode: '0644'

- name: deploy caddy stack
  community.docker.docker_compose_v2:
    project_src: /opt/stacks/caddy
    recreate: never
    files:
    - compose.yml

# Lets public traffic through to Caddy. Re-adds the rule if Caddy's IP changed.
- name: allow public traffic to caddy
  ansible.builtin.command: /usr/local/bin/ufw-docker.sh allow caddy-caddy-1 {{ item }}
  loop: [80/tcp, 443/tcp, 443/udp]
  register: caddy_ufw
  changed_when: "'Skipping' not in caddy_ufw.stdout"
  when: not ansible_check_mode