- name: System Update and Upgrade
  block:
    - name: Install gnupg first (required for apt repository management)
      ansible.builtin.apt:
        name: gnupg
        state: present
        update_cache: true

    - name: Add Debian Testing repository (for specific packages like dasel and golang-1.24)
      when: ansible_distribution == "Debian"
      ansible.builtin.copy:
        content: |
          deb http://deb.debian.org/debian/ testing main contrib non-free non-free-firmware
        dest: /etc/apt/sources.list.d/debian-testing.list
        owner: root
        group: root
        mode: "0644"
    - name: Configure APT pinning for dasel (prefer testing over stable)
      when: ansible_distribution == "Debian"
      ansible.builtin.copy:
        content: |
          Package: *
          Pin: release a=stable
          Pin-Priority: 900

          Package: dasel
          Pin: release a=testing
          Pin-Priority: 990

          Package: *
          Pin: release a=testing
          Pin-Priority: 50
        dest: /etc/apt/preferences.d/dasel_pinning.pref
        owner: root
        group: root
        mode: "0644"
    - name: Set up APT pinning for golang-1.24
      ansible.builtin.copy:
        content: |
          Package: golang-1.24
          Pin: release n=trixie
          Pin-Priority: 900

          Package: *
          Pin: release n=trixie
          Pin-Priority: -1
        dest: /etc/apt/preferences.d/golang-1.24.pref
        owner: root
        group: root
        mode: "0644"
    - name: Update apt package cache
      ansible.builtin.apt:
        update_cache: true
    - name: Upgrade dist
      ansible.builtin.apt:
        upgrade: dist
    - name: Install packages
      ansible.builtin.apt:
        pkg: [
          acl,
          curl,
          dasel,
          dnsutils,
          git,
          golang-1.24,
          lsof,
          neovim,
          rsync,
          wget,
        ]
    - name: Create symlink for 'go' binary in /usr/local/bin
      ansible.builtin.file:
        src: /usr/lib/go-1.24/bin/go
        dest: /usr/local/bin/go
        state: link
        force: true
        owner: root
        group: root

- name: Configure Automatic Security Updates
  block:
    - name: Install unattended-upgrades and apt-listchanges
      ansible.builtin.apt:
        pkg:
          - unattended-upgrades
          - apt-listchanges
        state: present

    - name: Configure unattended-upgrades settings
      ansible.builtin.copy:
        content: |
          Unattended-Upgrade::Allowed-Origins {
              "${distro_id}:${distro_codename}";
              "${distro_id}:${distro_codename}-security";
              "${distro_id}ESMApps:${distro_codename}-apps-security";
              "${distro_id}ESM:${distro_codename}-infra-security";
              "${distro_id}:${distro_codename}-updates";
          };
          Unattended-Upgrade::DevRelease "false";
          Unattended-Upgrade::AutoFixInterruptedDpkg "true";
          Unattended-Upgrade::MinimalSteps "true";
          Unattended-Upgrade::Remove-Unused-Kernel-Packages "true";
          Unattended-Upgrade::Remove-Unused-Dependencies "true";
          Unattended-Upgrade::Automatic-Reboot "false";
          Unattended-Upgrade::Automatic-Reboot-WithUsers "false";
          Unattended-Upgrade::Automatic-Reboot-Time "03:00";
        dest: /etc/apt/apt.conf.d/50unattended-upgrades
        owner: root
        group: root
        mode: "0644"

    - name: Enable automatic updates
      ansible.builtin.copy:
        content: |
          APT::Periodic::Update-Package-Lists "1";
          APT::Periodic::Download-Upgradeable-Packages "1";
          APT::Periodic::AutocleanInterval "7";
          APT::Periodic::Unattended-Upgrade "1";
        dest: /etc/apt/apt.conf.d/20auto-upgrades
        owner: root
        group: root
        mode: "0644"

    - name: Configure dpkg to use new config files by default
      ansible.builtin.copy:
        content: |
          Dpkg::Options {
              "--force-confdef";
              "--force-confold";
          };
        dest: /etc/apt/apt.conf.d/10dpkg-options
        owner: root
        group: root
        mode: "0644"

- name: Remove Apache2 web server (conflicts with Caddy)
  block:
    - name: Stop Apache2 service
      ansible.builtin.systemd_service:
        name: apache2
        state: stopped
      failed_when: false
      register: apt_apache2_stop

    - name: Disable Apache2 service
      ansible.builtin.systemd_service:
        name: apache2
        enabled: false
      failed_when: false
      when: apt_apache2_stop.status is defined

    - name: Remove Apache2 packages (keep apache2-utils)
      ansible.builtin.apt:
        name:
          - apache2
          - apache2-bin
          - apache2-data
          - libapache2-mod-php8.4
        state: absent
        autoremove: true
        purge: true
      register: apt_apache2_remove

    - name: Ensure apache2-utils is still installed
      ansible.builtin.apt:
        name: apache2-utils
        state: present
