- name: Install and configure Colporteur
  block:
    - name: Create Colporteur system group
      ansible.builtin.group:
        name: "{{ colporteur_sys_group }}"
        system: true
        state: present

    - name: Create Colporteur system user
      ansible.builtin.user:
        name: "{{ colporteur_sys_user }}"
        group: "{{ colporteur_sys_group }}"
        shell: /usr/sbin/nologin
        home: "{{ colporteur_install_path }}"
        create_home: false
        system: true
        state: present

    - name: Create Colporteur installation directory
      ansible.builtin.file:
        path: "{{ colporteur_install_path }}"
        state: directory
        owner: "{{ colporteur_sys_user }}"
        group: "{{ colporteur_sys_group }}"
        mode: "0755"

    - name: Create Colporteur data directory
      ansible.builtin.file:
        path: "{{ colporteur_data_dir }}"
        state: directory
        owner: "{{ colporteur_sys_user }}"
        group: "{{ colporteur_sys_group }}"
        mode: "0700"

    - name: Create Colporteur feeds directory
      ansible.builtin.file:
        path: "{{ colporteur_feeds_dir }}"
        state: directory
        owner: "{{ colporteur_sys_user }}"
        group: "{{ colporteur_sys_group }}"
        mode: "0755"

    - name: Create Colporteur config directory
      ansible.builtin.file:
        path: "{{ colporteur_config_dir }}"
        state: directory
        owner: root
        group: "{{ colporteur_sys_group }}"
        mode: "0750"

    - name: Check if Colporteur version file exists
      ansible.builtin.stat:
        path: "{{ colporteur_install_path }}/version"
      register: colporteur_version_file

    - name: Read installed Colporteur version
      when: colporteur_version_file.stat.exists
      ansible.builtin.slurp:
        src: "{{ colporteur_install_path }}/version"
      register: colporteur_installed_version_raw

    - name: Set installed Colporteur version fact
      ansible.builtin.set_fact:
        colporteur_installed_version: >-
          {{ colporteur_installed_version_raw.content | b64decode | trim
             if colporteur_version_file.stat.exists else '' }}

    - name: Fetch Colporteur binary checksum
      when: colporteur_installed_version != colporteur_version
      become: false
      delegate_to: localhost
      register: colporteur_checksum_content
      ansible.builtin.uri:
        url: "{{ colporteur_checksum_url }}"
        return_content: true

    - name: Set Colporteur checksum fact
      when: colporteur_installed_version != colporteur_version
      ansible.builtin.set_fact:
        colporteur_checksum_sha256: "{{ colporteur_checksum_content.content.split() | first }}"

    - name: Download Colporteur binary archive
      when: colporteur_installed_version != colporteur_version
      ansible.builtin.get_url:
        url: "{{ colporteur_binary_url }}"
        dest: "/tmp/colporteur-{{ colporteur_version }}.tar.gz"
        mode: "0644"
        checksum: "sha256:{{ colporteur_checksum_sha256 }}"

    - name: Extract Colporteur binary archive
      when: colporteur_installed_version != colporteur_version
      ansible.builtin.unarchive:
        src: "/tmp/colporteur-{{ colporteur_version }}.tar.gz"
        dest: "{{ colporteur_install_path }}"
        remote_src: true
        owner: "{{ colporteur_sys_user }}"
        group: "{{ colporteur_sys_group }}"
        mode: "0755"
      notify: Restart colporteur

    - name: Ensure Colporteur binary permissions
      when: colporteur_installed_version != colporteur_version
      ansible.builtin.file:
        path: "{{ colporteur_install_path }}/colporteur"
        owner: "{{ colporteur_sys_user }}"
        group: "{{ colporteur_sys_group }}"
        mode: "0755"

    - name: Write installed version file
      when: colporteur_installed_version != colporteur_version
      ansible.builtin.copy:
        content: "{{ colporteur_version }}"
        dest: "{{ colporteur_install_path }}/version"
        owner: "{{ colporteur_sys_user }}"
        group: "{{ colporteur_sys_group }}"
        mode: "0644"

    - name: Deploy Colporteur config file
      ansible.builtin.copy:
        src: "{{ colporteur_config_src }}"
        dest: "{{ colporteur_config_dir }}/config.toml"
        owner: root
        group: "{{ colporteur_sys_group }}"
        mode: "0640"
      notify: Restart colporteur

    - name: Deploy Colporteur systemd service file
      ansible.builtin.template:
        src: templates/colporteur.service.j2
        dest: /etc/systemd/system/colporteur.service
        owner: root
        group: root
        mode: "0644"
      notify: Restart colporteur

    - name: Deploy Colporteur systemd timer file
      ansible.builtin.template:
        src: templates/colporteur.timer.j2
        dest: /etc/systemd/system/colporteur.timer
        owner: root
        group: root
        mode: "0644"
      notify: Restart colporteur

    - name: Enable and start Colporteur timer
      ansible.builtin.systemd_service:
        name: colporteur.timer
        enabled: true
        state: started
        daemon_reload: true

    - name: Hash Colporteur feeds password
      ansible.builtin.command:
        argv:
          - caddy
          - hash-password
          - --plaintext
          - "{{ colporteur_feeds_password }}"
      register: colporteur_hashed_password
      changed_when: false
      no_log: true

    - name: Set Colporteur hashed password fact
      ansible.builtin.set_fact:
        colporteur_hashed_password: "{{ colporteur_hashed_password.stdout | trim }}"

    - name: Deploy Colporteur Caddyfile
      ansible.builtin.template:
        src: templates/Caddyfile.j2
        dest: "/etc/caddy/sites/{{ colporteur_domain }}.caddyfile"
        owner: root
        group: root
        mode: "0644"
      notify: Restart caddy
