---
- name: Provision Potato Server Infrastructure
  hosts: potato
  become: true

  tasks:
    - name: Update apt cache
      apt:
        update_cache: yes
        cache_valid_time: 3600

    - name: Install System Dependencies
      apt:
        name:
          - cockpit
          - nginx
          - certbot
          - python3-certbot-nginx
          - git
        state: present

    # --- FORGEJO SYSTEM USER & DIRECTORIES ---
    - name: Create Git system user for Forgejo
      user:
        name: git
        home: /home/git
        shell: /bin/bash
        system: yes

    - name: Create Forgejo application directories
      file:
        path: "{{ item }}"
        state: directory
        owner: git
        group: git
        mode: '0750'
      loop:
        - /var/lib/forgejo
        - /var/lib/forgejo/data
        - /var/lib/forgejo/custom
        - /var/lib/forgejo/log
        - /etc/forgejo

    # --- FORGEJO BINARY INSTALLATION ---
    - name: Download Forgejo Linux AMD64 binary
      get_url:
        url: "https://codeberg.org/forgejo/forgejo/releases/download/v{{ forgejo_version }}/forgejo-{{ forgejo_version }}-linux-amd64"
        dest: /usr/local/bin/forgejo
        mode: '0755'
        owner: root
        group: root

    - name: Provision Forgejo Systemd Service Unit
      copy:
        dest: /etc/systemd/system/forgejo.service
        content: |
          [Unit]
          Description=Forgejo (Git Service)
          After=syslog.target
          After=network.target
          After=postgresql.service

          [Service]
          Type=simple
          User=git
          Group=git
          WorkingDirectory=/var/lib/forgejo/
          Environment=USER=git HOME=/home/git FORGEJO_WORK_DIR=/var/lib/forgejo
          ExecStart=/usr/local/bin/forgejo web --config /etc/forgejo/app.ini
          Restart=always
          RestartSec=2s

          [Install]
          WantedBy=multi-user.target

    # --- SERVICE MANAGEMENT ---
    - name: Enable and start system infrastructure services
      service:
        name: "{{ item }}"
        state: started
        enabled: yes
      loop:
        - cockpit
        - nginx
        - forgejo

    - name: Remove default Nginx site configuration
      file:
        path: /etc/nginx/sites-enabled/default
        state: absent

    # --- NEW: NGINX REVERSE PROXY CONFIGURATION ---
    - name: Configure Nginx reverse proxy for Forgejo
      copy:
        dest: "/etc/nginx/sites-available/{{ domain_name }}"
        content: |
          server {
              listen 80;
              server_name {{ domain_name }};

              location / {
                  proxy_pass http://127.0.0.1:3000;
                  proxy_set_header Host $host;
                  proxy_set_header X-Real-IP $remote_addr;
                  proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
                  proxy_set_header X-Forwarded-Proto $scheme;
              }
          }

    - name: Enable Forgejo Nginx site config symlink
      file:
        src: "/etc/nginx/sites-available/{{ domain_name }}"
        dest: "/etc/nginx/sites-enabled/{{ domain_name }}"
        state: link

    - name: Reload Nginx to apply proxy routing
      service:
        name: nginx
        state: reloaded

    # --- NEW: LET'S ENCRYPT CERTIFICATE PROVISIONING ---
    - name: Obtain SSL certificate from Let's Encrypt via Certbot
      command: >
        certbot --nginx
        -d {{ domain_name }}
        --email {{ letsencrypt_email }}
        --agree-tos
        --non-interactive
        --keep-until-expiring
      args:
        creates: "/etc/letsencrypt/live/{{ domain_name }}/fullchain.pem"