---
- name: Update system (APT + Flatpak)
  hosts: all:!localhost
  become: true
  gather_facts: false
  serial: 5

  tasks:

    # ---------------------------------------------------------
    # Connectivity
    # ---------------------------------------------------------

    - name: Ensure SSH is reachable (skip host if not)
      ansible.builtin.wait_for:
        host: "{{ ansible_host | default(inventory_hostname) }}"
        port: 22
        timeout: 5
      delegate_to: localhost
      register: ssh_check
      ignore_errors: true
      become: false

    - name: Skip host if SSH is unreachable
      ansible.builtin.meta: end_host
      when: ssh_check is failed

    - name: Gather facts
      ansible.builtin.setup:

    - name: Ping with retries (handle intermittent flaps)
      ansible.builtin.ping:
      register: ping_result
      retries: 5
      delay: 5
      until: ping_result is success

    # ---------------------------------------------------------
    # APT
    # ---------------------------------------------------------

    - name: Update apt cache
      ansible.builtin.apt:
        update_cache: true
        lock_timeout: 300

    - name: Perform full upgrade
      ansible.builtin.apt:
        upgrade: full
        autoremove: true
        autoclean: true
        lock_timeout: 300
      register: apt_upgrade
      retries: 3
      delay: 10
      until: apt_upgrade is succeeded

    - name: Fix broken packages
      ansible.builtin.command:
        cmd: apt-get -f install -y
      register: fix_result
      failed_when: false
      changed_when: "'Setting up' in fix_result.stdout"

    # ---------------------------------------------------------
    # Flatpak
    # ---------------------------------------------------------

    - name: Check if Flatpak is installed
      ansible.builtin.command:
        cmd: which flatpak
      register: flatpak_check
      changed_when: false
      failed_when: false

    - name: Update system Flatpaks
      ansible.builtin.command:
        cmd: flatpak update -y --noninteractive --system
      register: flatpak_system_update
      changed_when: "'Nothing to do' not in flatpak_system_update.stdout"
      failed_when: false
      when: flatpak_check.rc == 0

    - name: Update user Flatpaks
      ansible.builtin.command:
        cmd: flatpak update -y --noninteractive --user
      become: false
      register: flatpak_user_update
      changed_when: "'Nothing to do' not in flatpak_user_update.stdout"
      failed_when: false
      when: flatpak_check.rc == 0

    - name: Remove unused Flatpaks
      ansible.builtin.command:
        cmd: flatpak uninstall -y --noninteractive --unused
      register: flatpak_unused
      changed_when: "'Nothing unused to uninstall' not in flatpak_unused.stdout"
      failed_when: false
      when: flatpak_check.rc == 0

    # ---------------------------------------------------------
    # Snap
    # ---------------------------------------------------------

    - name: Check if Snap is installed
      ansible.builtin.command:
        cmd: which snap
      register: snap_check
      changed_when: false
      failed_when: false

    - name: Update snap packages
      ansible.builtin.command:
        cmd: snap refresh
      register: snap_refresh
      changed_when: "'All snaps up to date' not in snap_refresh.stdout"
      failed_when: false
      when: snap_check.rc == 0

    # ---------------------------------------------------------
    # Reboot check
    # ---------------------------------------------------------

    - name: Check if reboot is required
      ansible.builtin.stat:
        path: /var/run/reboot-required
      register: reboot_required

    - name: Notify if reboot required
      ansible.builtin.debug:
        msg: "Reboot required on {{ inventory_hostname }}"
      when: reboot_required.stat.exists

    # ---------------------------------------------------------
    # Portainer
    # Only runs when --tags portainer is specified
    # ---------------------------------------------------------

    - name: Update Portainer containers
      ansible.builtin.include_role:
        name: update_portainer
        apply:
          tags:
            - portainer
      tags:
        - never
        - portainer