---
- name: Deploy Element + Matrix + Matrix_admin + TURN + NGINX-PM + Teamspeak
  hosts: all
  become: true
  collections:
    - containers.podman

  vars_files:
    - ../vars/vars.yml                     # ← our variable file

  tasks:

    # -----------------------------------------------------------------
    # Install podman, create network, create volumes …
    # -----------------------------------------------------------------
    - name: Install podman package
      ansible.builtin.package:
        name: podman
        state: present

    - name: Create podman network "{{ podman_network }}"
      containers.podman.podman_network:
        name: "{{ podman_network }}"
        driver: bridge
        subnet: "10.36.0.0/16"
        state: present

    - name: Ensure required podman volumes exist
      containers.podman.podman_volume:
        name: "{{ item }}"
        driver: local
        state: present
      loop:
        - "{{ vol_synapse }}"
        - "{{ vol_media }}"
        - "{{ vol_turn }}"
        - "{{ vol_nginx }}"
        - "{{ vol_teamspeak }}"
        - "{{ vol_db }}"  
        - "{{ npm_data }}"
        - "{{ npm_letsencrypt }}"
        - "{{ keycloak_data }}"
        - "{{ vol_kc_db }}"

    # -----------------------------------------------------------------
    # Pull required images 
    # -----------------------------------------------------------------

    - name: Pull coturn image
      containers.podman.podman_image:
        name: "{{ turn_image }}"
        state: present

    - name: Pull Synapse image
      containers.podman.podman_image:
        name: "{{ synapse_image }}"
        state: present

    - name: Pull NGINX image
      containers.podman.podman_image:
        name: "{{ nginx_image }}"
        state: present

    - name: Pull Teamspeak image
      containers.podman.podman_image:
        name: "{{ teamspeak_image }}"
        state: present
    
    - name: Pull Nginx Proxy Manager image
      containers.podman.podman_image:
        name: "{{ npm_image }}"
        state: present

    - name: Pull Postgres DB image
      containers.podman.podman_image:
        name: "{{ db_image }}"
        state: present

    - name: Pull Keycloak Image
      containers.podman.podman_image:
        name: "{{ keycloak_image }}"
        state: present

    # -----------------------------------------------------------------
    # Render all configuration files from the templates
    # -----------------------------------------------------------------

    - name: Render coturn config
      ansible.builtin.template:
        src: turnserver.conf.j2
        dest: "{{ turn_conf_path }}"
        mode: "0644"

    - name: Render Synapse homeserver.yaml
      ansible.builtin.template:
        src: homeserver.yaml.j2
        dest: "{{ synapse_cfg_path }}"
        mode: "0644"

    - name: Render landing page index.html
      ansible.builtin.template:
        src: landing.html.j2    
        dest: "{{ nginx_html_path }}"        
        mode: "0644"

    # - name: Render Synapse Secret key
    #   ansible.builtin.template:
    #     src: matrix.fpov.space.signing.key
    #     dest: "{{ synapse_secret_key_path }}"
    #     mode: "0644"

    - name: Render Synapse log config file
      ansible.builtin.template:
        src: matrix.fpov.space.log.config.j2
        dest: "{{ synapse_log_config }}"
        mode: "0644"

    - name: Render Element config file
      ansible.builtin.template:
        src: config.json.j2
        dest: "{{ element_config_path }}"
        mode: "0644"

    # -----------------------------------------------------------------
    # Start the NGINX Proxy Manager Container
    # -----------------------------------------------------------------

    - name: Start Nginx Proxy manager
      containers.podman.podman_container:
        name: npm 
        image: "{{ npm_image }}"
        state: started
        ports:
          - "80:80"
          - "443:443"
          - "81:81"
        volumes:
          - "{{ npm_data }}:/data"
          - "{{ npm_letsencrypt }}:/etc/letsencrypt"
        network: "{{ podman_network }}"

    # -----------------------------------------------------------------
    # Start the Coturn container
    # -----------------------------------------------------------------

    - name: Start coturn container
      containers.podman.podman_container:
        name: turn
        image: "{{ turn_image }}"
        state: started
        ports:
          - "{{ turn_listen_port }}:{{ turn_listen_port }}/udp"
          - "{{ turn_listen_port }}:{{ turn_listen_port }}/tcp"
          - "{{ turn_tls_port }}:{{ turn_tls_port }}/udp"
          - "{{ turn_tls_port }}:{{ turn_tls_port }}/tcp"
        volumes:
          - "{{ vol_turn }}:/var/lib/turn"
          - "{{ turn_conf_path }}:/etc/turnserver.conf:ro"
        command: "-c /etc/turnserver.conf"
        network: "{{ podman_network }}"
        restart_policy: always


    # -----------------------------------------------------------------
    # Start the Matrix-Synaps and supporting DB containers
    # -----------------------------------------------------------------

    - name: start Matrix Database container
      containers.podman.podman_container:
        name: synapse-db
        image: "{{ db_image }}"
        state: started
        env:
          POSTGRES_USER: "{{ postgres_user }}"
          POSTGRES_PASSWORD: "{{ postgres_pw }}"
          POSTGRES_DB: "{{ postgres_db }}"
        volumes:
          - "{{ vol_db }}:/var/lib/postgresql/data"        
        network: "{{ podman_network }}"
        restart_policy: always

    - name: Start Synapse container
      containers.podman.podman_container:
        name: "{{ matrix_container_name }}"  
        image: "{{ synapse_image }}"
        state: started
        ports:
          - "{{ synapse_http_port }}:{{ synapse_http_port }}"
        volumes:
          - "{{ vol_synapse }}:/data:Z"
          - "{{ vol_media }}:/data/media_store:Z"
          - "{{ synapse_cfg_path }}:/data/homeserver.yaml:Z"
          - "{{ synapse_secret_key_path }}:/data/key/matrix.fpov.space.signing.key:Z"
          - "{{ synapse_log_config }}:/data/matrix.fpov.space.log.config:Z"
        network: "{{ podman_network }}"
        restart_policy: always

    # -----------------------------------------------------------------
    # Start the Teamspeak Container
    # -----------------------------------------------------------------

    - name: Start Teamspeak container
      containers.podman.podman_container:
        name: "{{ teamspeak_container_name }}"
        image: "{{ teamspeak_image }}"
        env:
          TS3SERVER_LICENSE: accept
        state: started
        ports:
          # UDP voice port – exposed directly on the host (no Traefik)
          - "{{ teamspeak_udp_port }}:{{ teamspeak_udp_port }}/udp"
          # TCP query port – Traefik will forward it (see static config)
          - "{{ teamspeak_tcp_port }}:{{ teamspeak_tcp_port }}/tcp"
          # Optional file‑transfer port (exposed directly)
          - "{{ teamspeak_file_port }}:{{ teamspeak_file_port }}/tcp"
        volumes:
          - "{{ vol_teamspeak }}:/var/ts3server"
        network: "{{ podman_network }}"
        restart_policy: always

    # -----------------------------------------------------------------
    # Matrix Admin Panel
    # -----------------------------------------------------------------

    - name: Start Matrix Admin panel
      containers.podman.podman_container:
        name: "{{ admin_container_name }}"
        image: "{{ synapse_admin_image }}"
        state: started
        network: "{{ podman_network }}"
        restart_policy: always

    # -----------------------------------------------------------------
    # Element Web app
    #------------------------------------------------------------------
    - name: start Element Web Application
      containers.podman.podman_container:
        name: "{{ element_container_name }}"
        image: "{{ element_image }}"
        env:
          ELEMENT_WEB_PORT=8008
        state: started
        volumes:
          - "{{ element_config_path }}:/app/config.json:Z"
        network: "{{ podman_network }}"
        restart_policy: always

    # -----------------------------------------------------------------
    # Start Keyclaok and supporting DB containers
    # -----------------------------------------------------------------

    - name: start Keyclaok Database container
      containers.podman.podman_container:
        name: keycloak-db
        image: "{{ db_image }}"
        state: started
        env:
          POSTGRES_USER: "{{ keycloak_postgres_user }}"
          POSTGRES_PASSWORD: "{{ keycloak_postgres_pw }}"
          POSTGRES_DB: "{{ keycloak_db }}"
        volumes:
          - "{{ vol_kc_db }}:/var/lib/postgresql/data"        
        network: "{{ podman_network }}"
        restart_policy: always

    - name:  Start Keycloak authentication container
      containers.podman.podman_container:
        name: "{{ keycloak_container_name }}"
        image: "{{ keycloak_image }}"
        command: ["start-dev"]
        env:
          KC_DB: postgres
          KC_DB_URL: jdbc:postgresql://keycloak-db/{{ keycloak_db }}
          KC_DB_USERNAME: "{{ keycloak_postgres_user }}"
          KC_DB_PASSWORD: "{{ keycloak_postgres_pw }}"
          KC_HOSTNAME: "{{ keycloak_domain }}"
          KC_HOSTNAME_PORT: "{{ kc_hn_port }}"
          KEYCLOAK_ADMIN: "{{ keycloak_admin }}"
          KC_BOOTSTRAP_ADMIN_PASSWORD: "{{ keycloak_pw }}"
          KC_PROXY_HEADERS: xforwarded
          KC_HTTP_ENABLED: "true"
          KC_HOSTNAME_STRICT: "{{ 'false' }}"
        volumes:
          - "{{ keycloak_data }}:/opt/keycloak/data:Z"
        network: "{{ podman_network }}"
        restart_policy: always