---
- name: Check whether Docker is available
  ansible.builtin.command:
    argv:
      - docker
      - info
  register: portainer_docker_info
  changed_when: false
  failed_when: false

- name: Find Docker containers
  when: portainer_docker_info.rc == 0
  block:
    - name: List all container IDs
      ansible.builtin.command:
        argv:
          - docker
          - container
          - ls
          - --all
          - --quiet
      register: portainer_all_containers
      changed_when: false

    - name: Inspect container images
      ansible.builtin.command:
        argv:
          - docker
          - container
          - inspect
          - --format
          - "{% raw %}{{.Config.Image}}{% endraw %}"
          - "{{ item }}"
      loop: "{{ portainer_all_containers.stdout_lines }}"
      register: portainer_container_inspections
      changed_when: false

    - name: Select Portainer CE and Business Edition server containers
      ansible.builtin.set_fact:
        portainer_container_ids: >-
          {{ portainer_container_inspections.results
             | selectattr('stdout', 'match',
                 '^(?:[^/]+/)?portainer/(?:portainer|portainer-(?:ce|ee))(?::|@|$)')
             | map(attribute='item')
             | list }}

    - name: Pull the latest release for each installed Portainer edition
      ansible.builtin.command:
        argv:
          - docker
          - image
          - pull
          - >-
            {{ 'portainer/portainer-ee:' ~ portainer_target_tag
               if 'portainer-ee' in item.stdout
               else 'portainer/portainer-ce:' ~ portainer_target_tag }}
      loop: "{{ portainer_container_inspections.results }}"
      loop_control:
        label: "{{ item.stdout }}"
      register: portainer_image_pulls
      changed_when: "'Downloaded newer image' in portainer_image_pulls.stdout"
      when:
        - item.stdout is match('^(?:[^/]+/)?portainer/(?:portainer|portainer-(?:ce|ee))(?::|@|$)')
        - not ansible_check_mode

    - name: Point the existing image reference at the latest release
      ansible.builtin.command:
        argv:
          - docker
          - image
          - tag
          - >-
            {{ 'portainer/portainer-ee:' ~ portainer_target_tag
               if 'portainer-ee' in item.stdout
               else 'portainer/portainer-ce:' ~ portainer_target_tag }}
          - "{{ item.stdout }}"
      loop: "{{ portainer_container_inspections.results }}"
      loop_control:
        label: "{{ item.stdout }}"
      changed_when: false
      when:
        - item.stdout is match('^(?:[^/]+/)?portainer/(?:portainer|portainer-(?:ce|ee))(?::|$)')
        - not ansible_check_mode

    - name: Update discovered Portainer containers
      ansible.builtin.command:
        argv: >-
          {{ ['docker', 'run', '--rm', '--pull', 'always',
              '--volume', '/var/run/docker.sock:/var/run/docker.sock',
              portainer_watchtower_image, '--run-once', '--cleanup', '--no-pull',
              '--include-stopped']
             + portainer_container_ids }}
      register: portainer_watchtower
      changed_when: >-
        (portainer_watchtower.stdout ~ portainer_watchtower.stderr)
        is regex('Updated=[1-9][0-9]*')
      when:
        - portainer_container_ids | length > 0
        - not ansible_check_mode

    - name: Report when no Portainer server is installed
      ansible.builtin.debug:
        msg: No Portainer CE or Business Edition server container found; skipping.
      when: portainer_container_ids | length == 0