#SPDX-License-Identifier: MIT-0
---
# tasks file for homarr

# =====================================================================
# 0. VALIDATION
# =====================================================================

- name: Validate encryption key
  ansible.builtin.assert:
    that:
      - homarr_secret_encryption_key | length == 64
      - homarr_secret_encryption_key is match('^[a-f0-9]+$')
    fail_msg: >-
      homarr_secret_encryption_key must be a 64-character hex string.
      Generate with: openssl rand -hex 32
      Provide via OpenBao, Ansible Vault or extra-vars.
    success_msg: Encryption key validation passed

# =====================================================================
# 1. PREPARATION: packages and directories before container start
# =====================================================================

- name: Ensure required packages are installed
  ansible.builtin.package:
    name:
      - sqlite3
      - python3-docker
    state: present

- name: Create docker compose directory
  ansible.builtin.file:
    path: "{{ homarr_docker_compose_dir }}"
    state: directory
    mode: '0755'

- name: Create Homarr data directories
  ansible.builtin.file:
    path: "{{ item }}"
    state: directory
    owner: "1000"
    group: "1000"
    mode: "0755"
  loop:
    - "{{ homarr_appdata_dir }}"
    - "{{ homarr_appdata_dir }}/db"

- name: Check if database already exists
  ansible.builtin.stat:
    path: "{{ homarr_db }}"
  register: db_exists

# =====================================================================
# 2. START CONTAINER
# =====================================================================

- name: Create docker-compose file for homarr
  ansible.builtin.template:
    src: docker-compose.yml.j2
    dest: "{{ homarr_docker_compose_dir }}/docker-compose.yml"
    mode: '0644'

- name: Start homarr containers
  community.docker.docker_compose_v2:
    project_src: "{{ homarr_docker_compose_dir }}"
    state: present

# =====================================================================
# 3. WAIT FOR DATABASE
# =====================================================================

- name: Wait for database to be created by Homarr
  ansible.builtin.wait_for:
    path: "{{ homarr_db }}"
    state: present
    timeout: 60
  when: not db_exists.stat.exists

- name: Wait for database schema to be initialized
  ansible.builtin.command:
    cmd: sqlite3 "{{ homarr_db }}" "SELECT name FROM sqlite_master WHERE type='table' AND name='board';"
  register: schema_check
  until: schema_check.stdout == "board"
  retries: 30
  delay: 2
  changed_when: false
  when: not db_exists.stat.exists

# =====================================================================
# 4. GENERATE BCRYPT HASH (on controller, not on target)
# =====================================================================

- name: Generate bcrypt hash for admin password
  ansible.builtin.shell:
    cmd: python3 -c "import bcrypt, sys; print(bcrypt.hashpw(sys.stdin.read().encode(), bcrypt.gensalt(rounds=10)).decode())"
    stdin: "{{ homarr_admin_password }}"
    stdin_add_newline: false
  delegate_to: localhost
  become: false
  register: bcrypt_result
  changed_when: false
  no_log: true

- name: Set bcrypt hash fact
  ansible.builtin.set_fact:
    homarr_bcrypt_hash: "{{ bcrypt_result.stdout }}"
  no_log: true

# =====================================================================
# 5. SEED DATABASE (only if local admin user does not exist yet)
# =====================================================================

- name: Check if local admin user exists
  ansible.builtin.command:
    cmd: sqlite3 "{{ homarr_db }}" "SELECT id FROM user WHERE id='user-local-admin';"
  register: admin_exists
  changed_when: false
  failed_when: false

- name: Seed Homarr database
  ansible.builtin.shell: |
    sqlite3 "{{ homarr_db }}" << 'SEEDSQL'
    BEGIN TRANSACTION;

    -- SERVER SETTINGS
    INSERT OR REPLACE INTO serverSetting (setting_key, value)
    VALUES
        ('analytics', '{"json": {"enableGeneral": false, "enableWidgetData": false, "enableIntegrationData": false, "enableUserData": false}}'),
        ('culture', '{"json": {"defaultLocale": "de"}}'),
        ('crawling', '{"json": {"crawlingEnabled": false}}'),
        ('board', '{"json": {"homeBoardId": "board-default", "mobileHomeBoardId": "board-default", "enableStatusByDefault": true, "forceDisableStatus": false, "defaultBoardId": "board-default"}}');

    -- SKIP ONBOARDING
    UPDATE onboarding SET step = 'finish', previous_step = 'settings';

    -- =================================================================
    -- GROUPS (must exist before groupMember)
    -- =================================================================

    -- OIDC admin group
    INSERT OR IGNORE INTO "group" (id, name, owner_id, position)
    VALUES ('group-oidc-admins', '{{ homarr_oidc_admin_group }}', NULL, 0);

    INSERT OR IGNORE INTO groupPermission (group_id, permission)
    VALUES
        ('group-oidc-admins', 'admin'),
        ('group-oidc-admins', 'board-create'),
        ('group-oidc-admins', 'board-full-access'),
        ('group-oidc-admins', 'integration-create'),
        ('group-oidc-admins', 'integration-full-access');

    -- Credentials admin group
    INSERT OR IGNORE INTO "group" (id, name, owner_id, position)
    VALUES ('group-credentials-admin', 'credentials-admin', NULL, 1);

    INSERT OR IGNORE INTO groupPermission (group_id, permission)
    VALUES
        ('group-credentials-admin', 'admin'),
        ('group-credentials-admin', 'board-create'),
        ('group-credentials-admin', 'board-full-access'),
        ('group-credentials-admin', 'integration-create'),
        ('group-credentials-admin', 'integration-full-access');

    -- =================================================================
    -- LOCAL ADMIN USER
    -- =================================================================

    INSERT OR IGNORE INTO user (id, name, email, password, email_verified, provider)
    VALUES (
        'user-local-admin',
        '{{ homarr_admin_username }}',
        '{{ homarr_admin_email }}',
        '{{ homarr_bcrypt_hash }}',
        1,
        'credentials'
    );

    -- Assign admin user to groups
    INSERT OR IGNORE INTO groupMember (group_id, user_id)
    VALUES
        ('group-credentials-admin', 'user-local-admin'),
        ('group-oidc-admins', 'user-local-admin');

    -- =================================================================
    -- BOARD
    -- =================================================================

    INSERT OR IGNORE INTO board (
        id, name, is_public,
        primary_color, secondary_color, opacity,
        background_image_attachment, background_image_repeat, background_image_size,
        item_radius, disable_status
    )
    VALUES (
        'board-default',
        '{{ homarr_default_board_name }}',
        {% if homarr_default_board_public %}1{% else %}0{% endif %},
        '#fa5252',
        '#fd7e14',
        100,
        'fixed',
        'no-repeat',
        'cover',
        'lg',
        0
    );

    -- Layouts
    INSERT OR IGNORE INTO layout (id, name, board_id, column_count, breakpoint)
    VALUES
        ('layout-desktop', 'Desktop', 'board-default', 10, 0),
        ('layout-tablet', 'Tablet', 'board-default', 6, 768),
        ('layout-mobile', 'Mobile', 'board-default', 2, 480);

    -- Set home board for admin user (board exists now)
    UPDATE user SET home_board_id = 'board-default', mobile_home_board_id = 'board-default'
    WHERE id = 'user-local-admin';

    -- Section
    DELETE FROM section_layout WHERE section_id = 'section-apps';
    DELETE FROM item_layout WHERE section_id = 'section-apps';
    DELETE FROM section WHERE id = 'section-apps';

    INSERT INTO section (id, board_id, kind, x_offset, y_offset, name, options)
    VALUES (
        'section-apps',
        'board-default',
        'empty',
        0,
        0,
        'Applications',
        '{"json": {}}'
    );

    INSERT OR REPLACE INTO section_layout (section_id, layout_id, parent_section_id, x_offset, y_offset, width, height)
    VALUES
        ('section-apps', 'layout-desktop', NULL, 0, 0, 10, 3),
        ('section-apps', 'layout-tablet', NULL, 0, 0, 6, 4),
        ('section-apps', 'layout-mobile', NULL, 0, 0, 2, 6);

    -- Board permissions
    INSERT OR IGNORE INTO boardGroupPermission (board_id, group_id, permission)
    VALUES
        ('board-default', 'group-oidc-admins', 'full-access'),
        ('board-default', 'group-credentials-admin', 'full-access');

    -- =================================================================
    -- APPS
    -- =================================================================

    -- Nextcloud
    INSERT OR IGNORE INTO app (id, name, description, icon_url, href)
    VALUES (
        'app-nextcloud',
        'Nextcloud',
        'Cloud Storage & Collaboration',
        'https://cdn.jsdelivr.net/gh/walkxcode/dashboard-icons/png/nextcloud.png',
        'https://cloud.digitalboard.ch'
    );

    INSERT OR IGNORE INTO item (id, board_id, kind, options, advanced_options)
    VALUES (
        'item-nextcloud',
        'board-default',
        'app',
        '{"json": {"appId": "app-nextcloud"}}',
        '{"json": {}}'
    );

    INSERT OR REPLACE INTO item_layout (item_id, section_id, layout_id, x_offset, y_offset, width, height)
    VALUES
        ('item-nextcloud', 'section-apps', 'layout-desktop', 0, 0, 2, 1),
        ('item-nextcloud', 'section-apps', 'layout-tablet', 0, 0, 2, 1),
        ('item-nextcloud', 'section-apps', 'layout-mobile', 0, 0, 1, 1);

    -- Keycloak
    INSERT OR IGNORE INTO app (id, name, description, icon_url, href)
    VALUES (
        'app-keycloak',
        'Keycloak',
        'Identity & Access Management',
        'https://cdn.jsdelivr.net/gh/walkxcode/dashboard-icons/png/keycloak.png',
        'https://auth.digitalboard.ch'
    );

    INSERT OR IGNORE INTO item (id, board_id, kind, options, advanced_options)
    VALUES (
        'item-keycloak',
        'board-default',
        'app',
        '{"json": {"appId": "app-keycloak"}}',
        '{"json": {}}'
    );

    INSERT OR REPLACE INTO item_layout (item_id, section_id, layout_id, x_offset, y_offset, width, height)
    VALUES
        ('item-keycloak', 'section-apps', 'layout-desktop', 2, 0, 2, 1),
        ('item-keycloak', 'section-apps', 'layout-tablet', 2, 0, 2, 1),
        ('item-keycloak', 'section-apps', 'layout-mobile', 1, 0, 1, 1);

    -- Mailman
    INSERT OR IGNORE INTO app (id, name, description, icon_url, href)
    VALUES (
        'app-mailman',
        'Mailman',
        'Mailing List Manager',
        'https://cdn.jsdelivr.net/gh/walkxcode/dashboard-icons/png/mailman.png',
        'https://lists.digitalboard.ch'
    );

    INSERT OR IGNORE INTO item (id, board_id, kind, options, advanced_options)
    VALUES (
        'item-mailman',
        'board-default',
        'app',
        '{"json": {"appId": "app-mailman"}}',
        '{"json": {}}'
    );

    INSERT OR REPLACE INTO item_layout (item_id, section_id, layout_id, x_offset, y_offset, width, height)
    VALUES
        ('item-mailman', 'section-apps', 'layout-desktop', 4, 0, 2, 1),
        ('item-mailman', 'section-apps', 'layout-tablet', 4, 0, 2, 1),
        ('item-mailman', 'section-apps', 'layout-mobile', 0, 1, 1, 1);

    COMMIT;
    SEEDSQL
  args:
    executable: /bin/bash
  register: seed_result
  changed_when: seed_result.rc == 0
  when: admin_exists.stdout == ""
  notify: restart homarr