---
- name: Deploy Star Citizen Inventory (trade-hub)
  hosts: webservers

  vars:
    backend_image: sc-inventory-backend
    frontend_image: sc-inventory-frontend
    postgres_image: docker.io/library/postgres:16-alpine
    image_tag: latest
    network_name: sc-inventory
    frontend_port: "8080:80"
    postgres_volume: sc-inventory-data
    postgres_password: "{{ lookup('env', 'POSTGRES_PASSWORD') | default('sc_inventory_dev', true) }}"
    database_url: "postgresql+psycopg://sc_inventory:{{ postgres_password }}@db:5432/sc_inventory"
    # Set to true once the site is served over TLS.
    cookie_secure: "false"
    # Set to true to force image rebuilds even when the images already exist
    force_rebuild: false

  tasks:
    - name: Check whether podman is installed
      ansible.builtin.command: podman --version
      register: podman_check
      failed_when: false
      changed_when: false

    - name: Install podman if missing
      become: true
      ansible.builtin.package:
        name: podman
        state: present
      when: podman_check.rc != 0

    - name: Remove legacy Apache container if present
      containers.podman.podman_container:
        name: my-apache-server
        state: absent

    - name: Check if backend image exists
      ansible.builtin.command: podman image exists {{ backend_image }}:{{ image_tag }}
      register: backend_image_check
      failed_when: false
      changed_when: false

    - name: Check if frontend image exists
      ansible.builtin.command: podman image exists {{ frontend_image }}:{{ image_tag }}
      register: frontend_image_check
      failed_when: false
      changed_when: false

    - name: Build backend image
      ansible.builtin.command: >
        podman build -t {{ backend_image }}:{{ image_tag }}
        {{ playbook_dir }}/trade-hub/backend
      when: backend_image_check.rc != 0 or force_rebuild | bool

    - name: Build frontend image
      ansible.builtin.command: >
        podman build -t {{ frontend_image }}:{{ image_tag }}
        {{ playbook_dir }}/trade-hub/frontend
      when: frontend_image_check.rc != 0 or force_rebuild | bool

    # podman_container does not recreate a container whose image tag now
    # resolves to a new ID, so rebuilt images require removing them first.
    - name: Remove containers so rebuilt images are used
      containers.podman.podman_container:
        name: "{{ item }}"
        state: absent
      loop:
        - sc-inventory-backend
        - sc-inventory-frontend
      when: force_rebuild | bool

    - name: Create podman network
      containers.podman.podman_network:
        name: "{{ network_name }}"
        state: present

    - name: Create PostgreSQL data volume
      containers.podman.podman_volume:
        name: "{{ postgres_volume }}"
        state: present

    - name: Run PostgreSQL container (internal only)
      containers.podman.podman_container:
        name: sc-inventory-db
        image: "{{ postgres_image }}"
        state: started
        network: "{{ network_name }}"
        network_aliases:
          - db
        env:
          POSTGRES_USER: sc_inventory
          POSTGRES_PASSWORD: "{{ postgres_password }}"
          POSTGRES_DB: sc_inventory
        volumes:
          - "{{ postgres_volume }}:/var/lib/postgresql/data:Z"
        restart_policy: unless-stopped

    - name: Run backend container (internal only)
      containers.podman.podman_container:
        name: sc-inventory-backend
        image: "{{ backend_image }}:{{ image_tag }}"
        state: started
        network: "{{ network_name }}"
        # Network alias "backend" matches the compose service name, so the
        # nginx upstream (http://backend:8000) resolves in both deployments.
        network_aliases:
          - backend
        env:
          DATABASE_URL: "{{ database_url }}"
          DB_WAIT_SECONDS: "60"
          COOKIE_SECURE: "{{ cookie_secure }}"
        restart_policy: unless-stopped

    - name: Run frontend container (published port)
      containers.podman.podman_container:
        name: sc-inventory-frontend
        image: "{{ frontend_image }}:{{ image_tag }}"
        state: started
        network: "{{ network_name }}"
        ports:
          - "{{ frontend_port }}"
        restart_policy: unless-stopped

    - name: Verify the stack responds
      ansible.builtin.uri:
        url: http://localhost:8080/healthz
        status_code: 200
      register: health_result
      until: health_result.status == 200
      retries: 8
      delay: 10