---
- name: "Configure tududi application"
  hosts: all

  vars:
    app_name: "tududi"
    app_user: "{{ app_name }}"
    app_owner_uid: 1108
    app_owner_gid: 1108

    base_dir: "{{ (application_dir, app_name) | path_join }}"
    db_dir: "{{ (base_dir, 'db') | path_join }}"
    uploads_dir: "{{ (base_dir, 'uploads') | path_join }}"

  tasks:
    - name: "Create user and environment"
      ansible.builtin.import_role:
        name: owner
      vars:
        owner_name: "{{ app_user }}"
        owner_uid: "{{ app_owner_uid }}"
        owner_gid: "{{ app_owner_gid }}"
        owner_extra_groups: ["docker"]

    - name: "Create application internal directories"
      ansible.builtin.file:
        path: "{{ item }}"
        state: "directory"
        owner: "{{ app_user }}"
        group: "{{ app_user }}"
        mode: "0750"
      loop:
        - "{{ base_dir }}"
        - "{{ db_dir }}"
        - "{{ uploads_dir }}"

    # SQLite-база и загрузки бэкапятся restic'ом напрямую (без gobackup-дампа):
    # ночной прогон одного пользователя -> вероятность записи в момент чтения
    # ничтожна, а retention (90 дневных / 36 месячных) страхует от редкого
    # несогласованного снимка.
    - name: "Create backup targets file"
      ansible.builtin.copy:
        dest: "{{ base_dir }}/backup-targets"
        content: |
          {{ db_dir }}
          {{ uploads_dir }}
        owner: "{{ app_user }}"
        group: "{{ app_user }}"
        mode: "0640"

    - name: "Copy docker compose file"
      ansible.builtin.template:
        src: "./files/{{ app_name }}/docker-compose.template.yml"
        dest: "{{ base_dir }}/docker-compose.yml"
        owner: "{{ app_user }}"
        group: "{{ app_user }}"
        mode: "0640"
      # Секреты стоят прямыми значениями в environment: — без no_log их
      # печатает --diff. Файловых секретов tududi не умеет, снять не выйдет.
      no_log: true

    - name: "Run application with docker compose"
      community.docker.docker_compose_v2:
        project_src: "{{ base_dir }}"
        state: "present"
        remove_orphans: true
      tags:
        - run-app