- name: Install required system packages
  apt:
    pkg:
      - apt-transport-https
      - ca-certificates
      - curl
      - software-properties-common
      - python3-pip
      - virtualenv
      - python3-setuptools
      - duf
    state: latest
    update_cache: true

- name: setup shell
  import_tasks: shell.yml

- name: Add Docker GPG apt Key
  apt_key:
    url: https://download.docker.com/linux/ubuntu/gpg
    state: present

- name: Add Docker Repository
  apt_repository:
    repo: deb https://download.docker.com/linux/debian bookworm stable
    state: present

- name: Update apt and install docker-ce
  apt:
    name: docker-ce
    state: latest
    update_cache: true

- name: copy over ufw-docker.sh
  ansible.builtin.copy:
    src: ufw-docker.sh
    dest: /usr/local/bin/ufw-docker.sh
    owner: root
    mode: '0755'

- name: check ufw-docker rules
  ansible.builtin.command: /usr/local/bin/ufw-docker.sh check
  register: ufw_docker_check
  changed_when: false
  failed_when: false
  check_mode: false

- name: install ufw-docker rules
  ansible.builtin.command: /usr/local/bin/ufw-docker.sh install
  when: ufw_docker_check.rc != 0

# ufw-docker install asks for a ufw restart to load the new rules
- name: restart ufw after ufw-docker install
  ansible.builtin.systemd:
    name: ufw
    state: restarted
  when: ufw_docker_check.rc != 0

- name: Look up the shared docker network
  community.docker.docker_network_info:
    name: "{{ docker.network_name }}"
  register: lava_net
  tags: always

# True once the network has the reserved range. Fixed IPs other than Caddy's
# are only applied then, since today's dynamic containers may hold them.
- name: Record whether the shared network has the reserved range
  ansible.builtin.set_fact:
    lava_reserved: >-
      {{ lava_net.exists and
         (lava_net.network.IPAM.Config | map(attribute='IPRange', default='') | first) == docker.ip_range }}
  tags: always

- name: Create the shared docker network
  community.docker.docker_network:
    name: "{{ docker.network_name }}"
    driver: bridge
    ipam_config:
      - subnet: "{{ docker.subnet }}"
        gateway: "{{ docker.gateway }}"
        iprange: "{{ docker.ip_range }}"
  when: not lava_net.exists
  register: lava_created

- name: Mark a freshly created network as reserved
  ansible.builtin.set_fact:
    lava_reserved: true
  when: lava_created is changed

# Docker can't change a network's address range in place; recreating it
# needs every container detached first. See migrate-lava-network.yml.
- name: Warn if the shared network has the old address layout
  ansible.builtin.debug:
    msg: >-
      {{ docker.network_name }} has no reserved range (wanted {{ docker.ip_range }}),
      so other containers can take Caddy's fixed IP. Run migrate-lava-network.yml.
  when: lava_net.exists and not (lava_reserved | bool)

- name: make directories
  ansible.builtin.file:
    path: "{{ item }}"
    state: directory
  loop:
    - /opt/stacks
    - /opt/dockge

- name: template dockge compose file
  ansible.builtin.template:
    src: dockge-compose.yml.j2
    dest: /opt/dockge/dockge.yml
    owner: root
    mode: '0644'

# Deploy services by category for better organization and dependency management
- name: Deploy infrastructure services
  import_tasks: infrastructure/main.yml
  tags: [infrastructure, services]

- name: Deploy development services
  import_tasks: development/main.yml
  tags: [development, services]

- name: Deploy media services
  import_tasks: media/main.yml
  tags: [media, services]

- name: Deploy productivity services
  import_tasks: productivity/main.yml
  tags: [productivity, services]

- name: Deploy monitoring services
  import_tasks: monitoring/main.yml
  tags: [monitoring, services]

- name: Deploy communication services
  import_tasks: communication/main.yml
  tags: [communication, services]