---
- name: Install nginx and certbot
  apt:
    name:
      - nginx
      - certbot
      - python3-certbot-nginx
    state: present
    update_cache: true

- name: Remove default nginx site
  file:
    path: /etc/nginx/sites-enabled/default
    state: absent
  notify: Reload nginx

# git.friessn.de already has its own site file (deployed manually before this
# role existed, same one-file-per-domain convention as the other sites on this
# box) — this role only manages home.friessn.de.
- name: Deploy home.friessn.de nginx config
  template:
    src: home.friessn.de.conf.j2
    dest: /etc/nginx/sites-available/home.friessn.de
    mode: "0644"
  notify: Reload nginx

- name: Enable home.friessn.de nginx site
  file:
    src: /etc/nginx/sites-available/home.friessn.de
    dest: /etc/nginx/sites-enabled/home.friessn.de
    state: link
  notify: Reload nginx

- name: Obtain Let's Encrypt certificate for {{ domain }}
  command: >
    certbot --nginx -d {{ domain }}
    --non-interactive --agree-tos -m {{ gitea_admin_email }}
    --redirect
  args:
    creates: /etc/letsencrypt/live/{{ domain }}/fullchain.pem
  notify: Reload nginx

# Keycloak itself runs as a plain Docker container for the unrelated gcnm
# app (not managed by this role) — it's already published on
# 127.0.0.1:8080, this just fronts it with TLS on its own subdomain so
# Homekeeper (and anything else on the box) can treat it as a normal OIDC
# provider. Requires a DNS record for {{ keycloak_domain }} pointing at this
# VM before the certbot step below can succeed.
- name: Deploy auth.friessn.de nginx config
  template:
    src: auth.friessn.de.conf.j2
    dest: /etc/nginx/sites-available/{{ keycloak_domain }}
    mode: "0644"
  notify: Reload nginx

- name: Enable auth.friessn.de nginx site
  file:
    src: /etc/nginx/sites-available/{{ keycloak_domain }}
    dest: /etc/nginx/sites-enabled/{{ keycloak_domain }}
    state: link
  notify: Reload nginx

- name: Obtain Let's Encrypt certificate for {{ keycloak_domain }}
  command: >
    certbot --nginx -d {{ keycloak_domain }}
    --non-interactive --agree-tos -m {{ gitea_admin_email }}
    --redirect
  args:
    creates: /etc/letsencrypt/live/{{ keycloak_domain }}/fullchain.pem
  notify: Reload nginx

- name: Enable nginx
  service:
    name: nginx
    enabled: true
    state: started