---
# Deliberately narrow maintenance path for the us4 WireGuard service. The
# Compose file and all private key material remain on the server; this playbook
# only pulls its declared immutable image and recreates the named service.
- name: Update and recreate the approved WireGuard service
  hosts: wireguard
  become: true
  gather_facts: false
  serial: 1
  vars:
    wireguard_maintenance_confirm: false
  tasks:
    - name: Require explicit WireGuard maintenance confirmation
      ansible.builtin.assert:
        that:
          - wireguard_maintenance_confirm | bool
        fail_msg: >-
          This operation pulls the image declared in /opt/wireguard/compose.yml
          and briefly recreates WireGuard. Set wireguard_maintenance_confirm=true
          only during the approved maintenance window.

    - name: Create the local WireGuard rollback directory
      ansible.builtin.file:
        path: "{{ compose_project_dir }}/backups"
        state: directory
        owner: root
        group: root
        mode: "0700"

    - name: Create a timestamp for the rollback archive
      ansible.builtin.command:
        argv: [date, +%Y%m%dT%H%M%SZ]
      changed_when: false
      register: wireguard_backup_timestamp

    - name: Create a protected local rollback archive of WireGuard configuration
      ansible.builtin.shell:
        cmd: >-
          umask 077 && tar --create --gzip
          --file={{ compose_project_dir }}/backups/config-{{ wireguard_backup_timestamp.stdout }}.tar.gz
          --directory={{ compose_project_dir }} config
        executable: /bin/bash
      changed_when: true

    - name: Verify the compose declaration uses an immutable image digest
      ansible.builtin.command:
        argv:
          - docker
          - compose
          - --project-directory
          - "{{ compose_project_dir }}"
          - config
      changed_when: false
      register: wireguard_compose_config

    - name: Reject mutable WireGuard image declarations
      ansible.builtin.assert:
        that:
          - "'@sha256:' in wireguard_compose_config.stdout"
        fail_msg: >-
          Pin the WireGuard image to an approved immutable digest before using
          this maintenance playbook.

    - name: Pull the declared WireGuard image
      ansible.builtin.command:
        argv:
          - docker
          - compose
          - --project-directory
          - "{{ compose_project_dir }}"
          - pull
          - wireguard
      changed_when: true

    - name: Recreate the WireGuard container
      ansible.builtin.command:
        argv:
          - docker
          - compose
          - --project-directory
          - "{{ compose_project_dir }}"
          - up
          - -d
          - --no-deps
          - --force-recreate
          - wireguard
      changed_when: true

    - name: Verify WireGuard container state
      ansible.builtin.command:
        argv:
          - docker
          - compose
          - --project-directory
          - "{{ compose_project_dir }}"
          - ps
          - --all
      changed_when: false
      register: wireguard_compose_ps

    - name: Display WireGuard container state
      ansible.builtin.debug:
        var: wireguard_compose_ps.stdout_lines

    - name: Run the deployed WireGuard health check
      ansible.builtin.command:
        argv: [/usr/local/lib/vps-health/run]
      changed_when: false
      register: wireguard_health_report
      failed_when: wireguard_health_report.rc not in [0, 1]

    - name: Display sanitized WireGuard health result
      ansible.builtin.debug:
        msg: "{{ wireguard_health_report.stdout | default(wireguard_health_report.stderr, true) }}"