---
# Read-only control-plane audit. This play intentionally contains no package,
# file, service, container, or configuration mutation tasks.
- name: Audit managed VPS hosts without changes
  hosts: managed
  gather_facts: true
  become: false
  any_errors_fatal: false
  tasks:
    - name: Verify Docker Compose command is available
      ansible.builtin.command:
        argv:
          - docker
          - compose
          - version
      changed_when: false

    - name: Inspect configured Compose project
      ansible.builtin.command:
        argv:
          - docker
          - compose
          - --project-directory
          - "{{ compose_project_dir }}"
          - ps
          - --all
      register: audit_compose_ps
      changed_when: false
      failed_when: false

    - name: Inspect failed systemd units
      ansible.builtin.command:
        argv:
          - systemctl
          - --failed
          - --no-legend
          - --no-pager
      register: audit_failed_units
      changed_when: false
      failed_when: false

    - name: Inspect filesystem capacity
      ansible.builtin.command:
        argv:
          - df
          - -P
          - -x
          - tmpfs
          - -x
          - devtmpfs
      register: audit_filesystems
      changed_when: false

    - name: Inspect active listeners
      ansible.builtin.command:
        argv:
          - ss
          - -lntup
      register: audit_listeners
      changed_when: false
      failed_when: false

    - name: Report sanitized audit summary
      ansible.builtin.debug:
        msg:
          host: "{{ inventory_hostname }}"
          profiles: "{{ healthcheck_profiles | default([]) | join(', ') }}"
          os: "{{ ansible_distribution }} {{ ansible_distribution_version }}"
          kernel: "{{ ansible_kernel }}"
          compose_rc: "{{ audit_compose_ps.rc }}"
          failed_units: "{{ audit_failed_units.stdout_lines | default([]) }}"
          filesystem_lines: "{{ audit_filesystems.stdout_lines | default([]) }}"
          listener_lines: "{{ audit_listeners.stdout_lines | default([]) }}"