---
- name: New KVM server provisioning scripts
  hosts: all
  gather_facts: true
  vars:
    agent360_api_key: "6225dd3b2c8afd50166ae988"
    firewall_mode: "HARDWARE_NODE"
    timezone: "UTC"
    swap_file_path: "/var/lib/libvirt/swapfile"
    swap_file_size: "2G"
    main_server_ip: "{{ ansible_default_ipv4.address }}"
    monitoring_script_url: "https://monitoring.platform360.io/agent360.sh"
    kernelcare_installer_url: "https://kernelcare.com/installer"
    firewall360_install_url: "https://tgz.thecode.casa/firewall360/install.sh"
    firewall360_reset_url: "https://deploy.thecode.casa/firewall360/reset_firewall.sh"
    agent360_plugins_tgz_url: "https://tgz.thecode.casa/agent360_plugins/install.sh"
    agent360_plugins_deploy_url: "https://deploy.thecode.casa/agent360_plugins/install.sh"
    virtnbdbackup_install_url: "https://tgz.thecode.casa/virtnbdbackup/install.sh"
    backup_manager_install_url: "https://backup-manager.vm.plesk-server.com/agents/install"

  tasks:
    # ========================================================================
    # 1. SWAP FILE SETUP
    # ========================================================================
    - name: Create swap file directory if missing
      ansible.builtin.file:
        path: "{{ swap_file_path | dirname }}"
        state: directory
        mode: '0755'
      tags: [swap, prep]

    - name: Create swap file
      ansible.builtin.command: "fallocate -l {{ swap_file_size }} {{ swap_file_path }}"
      args:
        creates: "{{ swap_file_path }}"
      tags: [swap, prep]

    - name: Set secure permissions (600) on swap file
      ansible.builtin.file:
        path: "{{ swap_file_path }}"
        mode: '0600'
      tags: [swap, prep]

    - name: Initialize swap area
      ansible.builtin.command: "mkswap {{ swap_file_path }}"
      args:
        creates: "{{ swap_file_path }}.initialized"
      notify: Mark swap as initialized
      tags: [swap, prep]

    - name: Enable swap file immediately
      ansible.builtin.command: "swapon {{ swap_file_path }}"
      register: swapon_result
      changed_when: "'already active' not in swapon_result.stderr"
      failed_when: swapon_result.rc != 0 and 'already active' not in swapon_result.stderr
      tags: [swap, prep]

    - name: Enable all swaps from /etc/fstab (swapon -av)
      ansible.builtin.command: "swapon -av"
      register: swapon_av
      changed_when: false
      tags: [swap, prep]

    - name: Ensure swap entry exists in /etc/fstab
      ansible.builtin.lineinfile:
        path: /etc/fstab
        line: "{{ swap_file_path }} none swap sw 0 0"
        regexp: "^{{ swap_file_path }}\\s+none\\s+swap"
        state: present
        validate: 'findmnt -T %s'
      tags: [swap, prep, fstab]

    # ========================================================================
    # 2. TIMEZONE CONFIGURATION
    # ========================================================================
    - name: Set system timezone to {{ timezone }}
      community.general.timezone:
        name: "{{ timezone }}"
      tags: [config, timezone]

    # ========================================================================
    # 3. KERNELCARE INSTALLATION
    # ========================================================================
    - name: Install KernelCare
      ansible.builtin.shell: |
        set -o pipefail
        curl -s -L {{ kernelcare_installer_url }} | bash
      args:
        executable: /bin/bash
        creates: /usr/bin/kcare
      register: kernelcare_install
      changed_when: kernelcare_install.rc == 0
      tags: [kernelcare, security]

    - name: Enable and start KernelCare service
      ansible.builtin.systemd:
        name: kcare
        enabled: true
        state: started
        daemon_reload: true
      tags: [kernelcare, security]

    - name: Display KernelCare licensing reminder
      ansible.builtin.debug:
        msg: |
          ⚠️  KERNELCARE LICENSE REMINDER ⚠️
          Please license this IP in your KernelCare portal:
          → {{ main_server_ip }}
          Visit: https://kernelcare.com/client-area
      tags: [kernelcare, reminder]

    # ========================================================================
    # 4. FIREWALL360 INSTALLATION (with mode input)
    # ========================================================================
    - name: Install Firewall360
      ansible.builtin.shell: "bash <(curl -sL {{ firewall360_install_url }}) <<< '{{ firewall_mode }}'"
      args:
        executable: /bin/bash
      register: firewall_install
      changed_when: firewall_install.rc == 0
      tags: [firewall, security]

    # ========================================================================
    # 5. FIREWALL360 RESET
    # ========================================================================
    - name: Reset Firewall360 configuration
      ansible.builtin.shell: "bash <(curl -sL {{ firewall360_reset_url }})"
      args:
        executable: /bin/bash
      register: firewall_reset
      changed_when: firewall_reset.rc == 0
      tags: [firewall, security]

    # ========================================================================
    # 6. AGENT360 MONITORING INSTALLATION
    # ========================================================================
    - name: Download Agent360 installation script
      ansible.builtin.get_url:
        url: "{{ monitoring_script_url }}"
        dest: /tmp/agent360.sh
        mode: '0755'
        timeout: 30
      tags: [monitoring, agent360]

    - name: Install Agent360 monitoring agent
      ansible.builtin.shell: |
        set -o pipefail
        bash /tmp/agent360.sh {{ agent360_api_key }}
      args:
        chdir: /tmp
      register: agent360_install
      changed_when: agent360_install.rc == 0
      tags: [monitoring, agent360]

    # ========================================================================
    # 7. AGENT360 CUSTOM PLUGINS
    # ========================================================================
    - name: Install plugin internal_server_metrics
      ansible.builtin.shell: |
        set -o pipefail
        curl -Ls {{ agent360_plugins_tgz_url }} | bash -s internal_server_metrics
      args:
        executable: /bin/bash
      register: plugin_internal
      changed_when: plugin_internal.rc == 0
      tags: [monitoring, plugins]

    - name: Install plugin vrrp_mon_cr
      ansible.builtin.shell: |
        set -o pipefail
        curl -Ls {{ agent360_plugins_deploy_url }} | bash -s vrrp_mon_cr
      args:
        executable: /bin/bash
      register: plugin_vrrp
      changed_when: plugin_vrrp.rc == 0
      tags: [monitoring, plugins]

    - name: Install plugin mdstat_ls
      ansible.builtin.shell: |
        set -o pipefail
        curl -Ls {{ agent360_plugins_deploy_url }} | bash -s mdstat_ls
      args:
        executable: /bin/bash
      register: plugin_mdstat
      changed_when: plugin_mdstat.rc == 0
      tags: [monitoring, plugins]

    # ========================================================================
    # 8. NBD MODULE + VIRTNBDBACKUP
    # ========================================================================
    - name: Ensure NBD module loads at boot
      ansible.builtin.copy:
        content: "nbd\n"
        dest: /etc/modules-load.d/nbd.conf
        mode: '0644'
      tags: [backup, nbd, prep]

    - name: Load NBD kernel module immediately
      community.general.modprobe:
        name: nbd
        state: present
      tags: [backup, nbd, prep]

    - name: Install virtnbdbackup
      ansible.builtin.shell: |
        set -o pipefail
        curl -s {{ virtnbdbackup_install_url }} | bash
      args:
        executable: /bin/bash
      register: virtnbd_install
      changed_when: virtnbd_install.rc == 0
      tags: [backup, virtnbd]

    # ========================================================================
    # 9. BACKUP-MANAGER INSTALLATION
    # ========================================================================
    - name: Download backup-manager installer
      ansible.builtin.get_url:
        url: "{{ backup_manager_install_url }}"
        dest: /tmp/installer.sh
        mode: '0755'
        timeout: 30
      tags: [backup, backup-manager]

    - name: Run backup-manager installer (pass 1)
      ansible.builtin.shell: |
        set -o pipefail
        /tmp/installer.sh
      args:
        chdir: /tmp
      register: backup_install_1
      changed_when: backup_install_1.rc == 0
      tags: [backup, backup-manager]

    - name: Run backup-manager installer (pass 2)
      ansible.builtin.shell: |
        set -o pipefail
        /tmp/installer.sh
      args:
        chdir: /tmp
      register: backup_install_2
      changed_when: backup_install_2.rc == 0
      tags: [backup, backup-manager]

    - name: Run backup-manager mount script
      ansible.builtin.shell: |
        set -o pipefail
        /tmp/mount.sh
      args:
        chdir: /tmp
      register: backup_mount
      changed_when: backup_mount.rc == 0
      tags: [backup, backup-manager]

    # ========================================================================
    # 10. POST-INSTALL SUMMARY
    # ========================================================================
    - name: Display provisioning completion summary
      ansible.builtin.debug:
        msg: |
          ✅ SERVER PROVISIONING COMPLETE ✅
          Configuration applied:
          • Swap: {{ swap_file_path }} ({{ swap_file_size }}) → active
          • Timezone: {{ timezone }}
          • KernelCare: installed (license IP: {{ main_server_ip }})
          • Firewall360: {{ firewall_mode }} mode + reset
          • Agent360: monitoring + 3 plugins installed
          • NBD/virtnbdbackup: ready
          • backup-manager: installed + mounted
          Quick verification commands:
            swapon --show
            timedatectl
            systemctl status kcare
            firewall360 status
            agent360 status
            lsmod | grep nbd
      tags: [verify, always]
  handlers:
    - name: Mark swap as initialized
      ansible.builtin.file:
        path: "{{ swap_file_path }}.initialized"
        state: touch
        mode: '0644'