# nextcloud/update_uptime_kuma.yml
- name: Update Uptime Kuma on VM via Proxmox
  hosts: proxmox
  gather_facts: false
  become: true
  become_user: root
  become_method: sudo

  vars:
    # --- Connection to VM (provided by Semaphore env vars) ---
    vm_ip:   "{{ lookup('env', 'VM_IP') }}"
    vm_user: "{{ lookup('env', 'VM_USER') }}"
    vm_pass: "{{ lookup('env', 'VM_PASS') }}"
    use_sudo: false

    # --- Debug toggle ---
     # Set DEBUG=1 in Semaphore to see full stdout/stderr (disables no_log)
    debug: "{{ (lookup('env','DEBUG') | default('0')) | bool }}"

    # --- Uptime Kuma specifics ---
    kuma_project: "uptime-kuma"                    # docker compose project name
    kuma_compose_file: "/data/compose/uptime-kuma.yml"
    kuma_service: "uptime-kuma"                    # service name in the compose file
    kuma_image: "louislam/uptime-kuma:latest"
    kuma_port: 3001
    kuma_url: "{{ lookup('env', 'KUMA_URL') | default('', true) }}"  # optional public URL

    # Fixed container name used in your compose (conflicts if an older non-compose/Portainer container exists)
    kuma_container_name: "uptime-kuma-dev"
    kuma_force_replace_conflict: true              # remove conflicting container automatically
    kuma_remove_orphans: true                      # remove containers not present in the compose file

    # Host path used by your volume mapping in compose (ensure it exists)
    kuma_data_dir: "/data/compose/kuma/data"

    # Docker command prefix (consistent behavior and quiet hints)
    docker_prefix: "unalias docker 2>/dev/null || true; DOCKER_CLI_HINTS=0; command docker"

    # Commands to run on the target VM (outputs are kept visible when debug=true)
    kuma_commands:
      # 0) pull image (helpful cache warm-up)
      - "{{ docker_prefix }} pull -q {{ kuma_image }}"
      # 1) show services resolved from the compose file (helps debugging service names)
      - "{{ docker_prefix }} compose -p {{ kuma_project }} -f {{ kuma_compose_file }} config --services"
      # 2) pull service
      - "{{ docker_prefix }} compose -p {{ kuma_project }} -f {{ kuma_compose_file }} pull {{ kuma_service }}"
      # 3) up the service (optionally remove orphans)
      - >-
        {{ docker_prefix }} compose -p {{ kuma_project }} -f {{ kuma_compose_file }}
        up -d --no-deps --force-recreate
        {{ '--remove-orphans' if kuma_remove_orphans else '' }}
        {{ kuma_service }}

  tasks:
    - name: Ensure sshpass is installed (for password-based SSH)  # English comments
      ansible.builtin.apt:
        name: sshpass
        state: present
        update_cache: yes

    # -------------------------
    # Preflight checks
    # -------------------------

    - name: Preflight | Ensure compose file exists on VM
      ansible.builtin.command:
        argv:
          - sshpass
          - -p
          - "{{ vm_pass }}"
          - ssh
          - -o
          - StrictHostKeyChecking=no
          - -o
          - ConnectTimeout=15
          - "{{ vm_user }}@{{ vm_ip }}"
          - bash
          - -lc
          - "test -r {{ kuma_compose_file }}"
      register: preflight_compose_exists
      changed_when: false
      failed_when: preflight_compose_exists.rc != 0
      no_log: "{{ not debug }}"

    - name: Preflight | Validate compose file syntax
      ansible.builtin.command:
        argv:
          - sshpass
          - -p
          - "{{ vm_pass }}"
          - ssh
          - -o
          - StrictHostKeyChecking=no
          - -o
          - ConnectTimeout=15
          - "{{ vm_user }}@{{ vm_ip }}"
          - bash
          - -lc
          - "{{ docker_prefix }} compose -f {{ kuma_compose_file }} config -q"
      register: preflight_compose_valid
      changed_when: false
      failed_when: preflight_compose_valid.rc != 0
      no_log: "{{ not debug }}"

    - name: Preflight | Ensure service exists in compose file
      ansible.builtin.command:
        argv:
          - sshpass
          - -p
          - "{{ vm_pass }}"
          - ssh
          - -o
          - StrictHostKeyChecking=no
          - -o
          - ConnectTimeout=15
          - "{{ vm_user }}@{{ vm_ip }}"
          - bash
          - -lc
          - >-
            {{ docker_prefix }} compose -f {{ kuma_compose_file }} config --services | grep -x {{ kuma_service }}
      register: preflight_service_exists
      changed_when: false
      failed_when: preflight_service_exists.rc != 0
      no_log: "{{ not debug }}"

    - name: Preflight | Ensure Kuma data dir exists (host path from compose)
      ansible.builtin.command:
        argv:
          - sshpass
          - -p
          - "{{ vm_pass }}"
          - ssh
          - -o
          - StrictHostKeyChecking=no
          - -o
          - ConnectTimeout=15
          - "{{ vm_user }}@{{ vm_ip }}"
          - bash
          - -lc
          - "mkdir -p {{ kuma_data_dir }}"
      changed_when: false
      no_log: "{{ not debug }}"

    - name: Preflight | Detect conflicting container by fixed name
      ansible.builtin.command:
        argv:
          - sshpass
          - -p
          - "{{ vm_pass }}"
          - ssh
          - -o
          - StrictHostKeyChecking=no
          - -o
          - ConnectTimeout=15
          - "{{ vm_user }}@{{ vm_ip }}"
          - bash
          - -lc
          - "docker ps -a --filter name=^/{{ kuma_container_name }}$ --format '{{'{{'}}.ID{{'}}'}}'"
      register: kuma_conflict
      changed_when: false
      failed_when: false
      no_log: "{{ not debug }}"

    - name: Preflight | Remove conflicting container if present (and allowed)
      ansible.builtin.command:
        argv:
          - sshpass
          - -p
          - "{{ vm_pass }}"
          - ssh
          - -o
          - StrictHostKeyChecking=no
          - -o
          - ConnectTimeout=15
          - "{{ vm_user }}@{{ vm_ip }}"
          - bash
          - -lc
          - "docker rm -f {{ kuma_container_name }}"
      when:
        - kuma_force_replace_conflict | bool
        - (kuma_conflict.stdout | default('') | trim) | length > 0
      changed_when: true
      no_log: "{{ not debug }}"

    # -------------------------
    # Update commands
    # -------------------------

    - name: Run Uptime Kuma update commands on VM (via SSH)  # Shows details when DEBUG=1
      ansible.builtin.command:
        argv:
          - sshpass
          - -p
          - "{{ vm_pass }}"
          - ssh
          - -o
          - StrictHostKeyChecking=no
          - -o
          - ConnectTimeout=15
          - "{{ vm_user }}@{{ vm_ip }}"
          - bash
          - -lc
          - "{{ ('sudo ' if use_sudo else '') + item }}"
      loop: "{{ kuma_commands }}"
      register: kuma_cmds
      changed_when: false
      ignore_errors: true
      no_log: "{{ not debug }}"

    - name: Show summarized outputs for each command (sanitized)
      ansible.builtin.debug:
        msg: |
          CMD: {{ item_short }}
          RC:  {{ item.rc }}
          STDOUT:
          {{ (item.stdout | default('')).strip() }}
          STDERR:
          {{ (item.stderr | default('')).strip() }}
      loop: "{{ kuma_cmds.results }}"
      vars:
        # Print only the remote "bash -lc" payload (no password leaks)
        item_short: "{{ (item.cmd | default([]))[-1] | default('N/A') }}"
      when: kuma_cmds is defined
      changed_when: false

    - name: Fail play if any Uptime Kuma command failed
      ansible.builtin.assert:
        that: "item.rc == 0"
        fail_msg: "Uptime Kuma update failed on VM: {{ (item.cmd | default([]))[-1] | default('N/A') }} (rc={{ item.rc }})"
        success_msg: "All Uptime Kuma update commands succeeded."
      loop: "{{ kuma_cmds.results }}"

    # -------------------------
    # Readiness checks
    # -------------------------

    - name: Kuma | Wait for web to respond (controller-side, if URL provided)
      ansible.builtin.uri:
        url: "{{ (kuma_url | regex_replace('/$','')) + '/' }}"
        method: GET
        return_content: true
        validate_certs: "{{ (kuma_url | default('')) is match('^https://') }}"
        status_code: 200
      register: kuma_controller
      delegate_to: localhost
      run_once: true
      when: kuma_url is defined and (kuma_url | length) > 0
      retries: 20
      delay: 2
      until: kuma_controller.status == 200 and ('Uptime Kuma' in (kuma_controller.content | default('')))
      failed_when: false
      changed_when: false

    - name: Kuma | VM-side probe (fallback to localhost:port, no auth)
      ansible.builtin.command:
        argv:
          - sshpass
          - -p
          - "{{ vm_pass }}"
          - ssh
          - -o
          - StrictHostKeyChecking=no
          - -o
          - ConnectTimeout=15
          - "{{ vm_user }}@{{ vm_ip }}"
          - bash
          - -lc
          - |
            python3 - <<'PY'
            # Simple readiness probe: fetch "/" and look for "Uptime Kuma" in HTML
            import sys, urllib.request
            try:
                with urllib.request.urlopen("http://127.0.0.1:{{ kuma_port }}/", timeout=15) as r:
                    body = r.read(8192).decode(errors='ignore')
                    if 'Uptime Kuma' in body:
                        print("OK")
            except Exception:
                pass
            PY
      register: kuma_vm
      changed_when: false
      failed_when: false
      when: (kuma_url is not defined) or (kuma_url | length == 0) or (kuma_controller.status | default(0)) != 200

    - name: Kuma | Decide readiness source
      ansible.builtin.set_fact:
        kuma_ready: >-
          {{
            (
              (kuma_controller is defined)
              and (kuma_controller.status|default(0))==200
              and ('Uptime Kuma' in (kuma_controller.content|default('')))
            ) or
            (
              (kuma_vm.stdout | default('')) | trim == 'OK'
            )
          }}
        kuma_ready_source: >-
          {{
            (
              (kuma_controller is defined)
              and (kuma_controller.status|default(0))==200
              and ('Uptime Kuma' in (kuma_controller.content|default('')))
            )
            | ternary('controller', 'vm')
          }}

    - name: Kuma | Print concise summary
      ansible.builtin.debug:
        msg: >-
          Uptime Kuma is {{ 'READY' if kuma_ready else 'NOT READY' }}
          (checked via {{ kuma_ready_source }}).
          URL={{ (kuma_url if (kuma_url|default('')|length>0) else 'http://'+vm_ip+':'+(kuma_port|string)) }}

    - name: Kuma | Not ready after retries
      ansible.builtin.debug:
        msg: "Kuma web není dostupná ani po pokusech."
      when: not kuma_ready