---
- name: Systembenutzer fuer die Jumphost-App anlegen
  ansible.builtin.group:
    name: "{{ jumphost_app_group }}"
    system: true

- name: Systembenutzer anlegen (kein Login-Shell, kein Home mit Zugriff fuer andere)
  ansible.builtin.user:
    name: "{{ jumphost_app_user }}"
    group: "{{ jumphost_app_group }}"
    system: true
    shell: /usr/sbin/nologin
    home: "{{ jumphost_home }}"
    create_home: false

- name: Python 3 + venv-Paket installieren
  ansible.builtin.apt:
    name:
      - python3
      - python3-venv
      - python3-pip
    state: present
    update_cache: true

- name: Verzeichnisse anlegen
  ansible.builtin.file:
    path: "{{ item }}"
    state: directory
    owner: "{{ jumphost_app_user }}"
    group: "{{ jumphost_app_group }}"
    mode: "0750"
  loop:
    - "{{ jumphost_home }}"
    - "{{ jumphost_data_dir }}"
    - "{{ jumphost_data_dir }}/recordings"
    - /run/jumphost
    - /var/log/jumphost

- name: Alten Anwendungscode entfernen (sauberes Redeploy)
  ansible.builtin.file:
    path: "{{ jumphost_home }}/{{ item }}"
    state: absent
  loop:
    - app
    - static
    - templates

- name: Anwendungscode kopieren
  # Bewusst ueber ansible.builtin.copy statt ansible.posix.synchronize, damit
  # das Playbook ohne zusaetzliche Collection auskommt und auch ohne rsync
  # auf Control-Node/Zielsystem funktioniert (Konzept-Anspruch: minimale
  # externe Abhaengigkeiten fuer den Deploy-Pfad selbst).
  ansible.builtin.copy:
    src: "{{ jumphost_repo_src }}/{{ item }}/"
    dest: "{{ jumphost_home }}/{{ item }}/"
    owner: "{{ jumphost_app_user }}"
    group: "{{ jumphost_app_group }}"
  loop:
    - app
    - static
    - templates
  notify: restart jumphost-app

- name: requirements.txt kopieren
  ansible.builtin.copy:
    src: "{{ jumphost_repo_src }}/requirements.txt"
    dest: "{{ jumphost_home }}/requirements.txt"
    owner: "{{ jumphost_app_user }}"
    group: "{{ jumphost_app_group }}"
  notify: restart jumphost-app

- name: Dateirechte auf Anwendungscode setzen
  ansible.builtin.file:
    path: "{{ jumphost_home }}"
    state: directory
    owner: "{{ jumphost_app_user }}"
    group: "{{ jumphost_app_group }}"
    recurse: true

- name: Virtualenv anlegen
  ansible.builtin.command:
    cmd: "python3 -m venv {{ jumphost_venv }}"
    creates: "{{ jumphost_venv }}/bin/python"
  become: true
  become_user: "{{ jumphost_app_user }}"

- name: Python-Abhaengigkeiten installieren
  ansible.builtin.pip:
    requirements: "{{ jumphost_home }}/requirements.txt"
    virtualenv: "{{ jumphost_venv }}"
  become: true
  become_user: "{{ jumphost_app_user }}"
  notify: restart jumphost-app