---
- name: New KVM server provisioning scripts
  hosts: kvm_node
  gather_facts: true
  vars:
    agent360_api_key: "6225dd3b2c8afd50166ae988"
    firewall_mode: "HARDWARE_NODE"
    timezone: "UTC"
    swap_file_path: "/var/lib/libvirt/swapfile"
    swap_file_size: "64G"
    main_server_ip: "{{ ansible_default_ipv4.address }}"
    monitoring_script_url: "https://monitoring.platform360.io/agent360.sh"
    kernelcare_installer_url: "https://kernelcare.com/installer"
    firewall360_install_url: "https://tgz.thecode.casa/firewall360/install.sh"
    firewall360_reset_url: "https://deploy.thecode.casa/firewall360/reset_firewall.sh"
    agent360_plugins_tgz_url: "https://tgz.thecode.casa/agent360_plugins/install.sh"
    agent360_plugins_deploy_url: "https://deploy.thecode.casa/agent360_plugins/install.sh"
    virtnbdbackup_install_url: "https://tgz.thecode.casa/virtnbdbackup/install.sh"
    backup_manager_install_url: "https://backup-manager.vm.plesk-server.com/agents/install"
    ls_tests_install_url: "https://deploy.thecode.casa/ls-tests/installer.sh"
    requisites:
      - wget
      - curl
      - vim
      - nano
      - net-tools
      - lsof
      - mc
      - bash-completion
      - fuse-sshfs

  tasks:
    # ========================================================================
    # install prerequisite packages
    # ========================================================================
    - name: Install prerequisite packages
      ansible.builtin.dnf:
        name: "{{ requisites }}"
        state: present
        update_cache: true
      tags: [packages, prep, system, stage1]

    # ========================================================================
    # SWAP FILE SETUP
    # ========================================================================
    - name: Create swap file directory if missing
      ansible.builtin.file:
        path: "{{ swap_file_path | dirname }}"
        state: directory
        mode: '0755'
      tags: [swap, stage1]

    - name: Create swap file
      ansible.builtin.command: "fallocate -l {{ swap_file_size }} {{ swap_file_path }}"
      args:
        creates: "{{ swap_file_path }}"
      tags: [swap, stage1]

    - name: Set secure permissions (600) on swap file
      ansible.builtin.file:
        path: "{{ swap_file_path }}"
        mode: '0600'
      tags: [swap, stage1]

    - name: Initialize swap area
      ansible.builtin.command: "mkswap {{ swap_file_path }}"
      args:
        creates: "{{ swap_file_path }}.initialized"
      notify: Mark swap as initialized
      tags: [swap, stage1]

    - name: Enable swap file immediately
      ansible.builtin.command: "swapon {{ swap_file_path }}"
      register: swapon_result
      changed_when: "'already active' not in swapon_result.stderr"
      failed_when: swapon_result.rc != 0 and 'already active' not in swapon_result.stderr
      tags: [swap, stage1]

    - name: Enable all swaps from /etc/fstab (swapon -av)
      ansible.builtin.command: "swapon -av"
      register: swapon_av
      changed_when: false
      tags: [swap, stage1]

    - name: Ensure swap entry exists in /etc/fstab
      ansible.builtin.lineinfile:
        path: /etc/fstab
        line: "{{ swap_file_path }} none swap sw 0 0"
        regexp: "^{{ swap_file_path }}\\s+none\\s+swap"
        state: present
        validate: 'findmnt -T %s'
      tags: [swap, fstab, stage1]

    # ========================================================================
    # TIMEZONE CONFIGURATION
    # ========================================================================
    - name: Set system timezone to {{ timezone }}
      community.general.timezone:
        name: "{{ timezone }}"
      tags: [config, timezone, stage1]

    # ========================================================================
    # KERNELCARE INSTALLATION
    # ========================================================================
    - name: Install KernelCare
      ansible.builtin.shell: |
        set -o pipefail
        curl -s -L {{ kernelcare_installer_url }} | bash
      args:
        executable: /bin/bash
        creates: /usr/bin/kcare
      register: kernelcare_install
      changed_when: kernelcare_install.rc == 0
      tags: [kernelcare, stage1]

    - name: Enable and start KernelCare service
      ansible.builtin.systemd:
        name: kcare
        enabled: true
        state: started
        daemon_reload: true
      tags: [kernelcare, stage1]

    - name: Display KernelCare licensing reminder
      ansible.builtin.debug:
        msg: |
          ⚠️  KERNELCARE LICENSE REMINDER ⚠️
          Please license this IP in your KernelCare portal:
          → {{ main_server_ip }}
          Visit: https://cln.cloudlinux.com/console
      tags: [kernelcare, stage1]

    # ========================================================================
    # AGENT360 MONITORING INSTALLATION
    # ========================================================================
    - name: Download Agent360 installation script
      ansible.builtin.get_url:
        url: "{{ monitoring_script_url }}"
        dest: /tmp/agent360.sh
        mode: '0755'
        timeout: 30
      tags: [monitoring, agent360, stage1]

    - name: Install Agent360 monitoring agent
      ansible.builtin.shell: |
        set -o pipefail
        bash /tmp/agent360.sh {{ agent360_api_key }}
      args:
        chdir: /tmp
      register: agent360_install
      changed_when: agent360_install.rc == 0
      tags: [monitoring, agent360, stage1]

    # ========================================================================
    # FIREWALL360 INSTALLATION
    # ========================================================================
    - name: Install Firewall360
      ansible.builtin.shell: "bash <(curl -sL {{ firewall360_install_url }}) <<< '{{ firewall_mode }}'"
      args:
        executable: /bin/bash
      register: firewall_install
      changed_when: firewall_install.rc == 0
      tags: [firewall, stage1]

    # ========================================================================
    # FIREWALL360 RESET
    # ========================================================================
    - name: Reset Firewall360 configuration
      ansible.builtin.shell: "bash <(curl -sL {{ firewall360_reset_url }})"
      args:
        executable: /bin/bash
      register: firewall_reset
      changed_when: firewall_reset.rc == 0
      tags: [firewall, stage1]

    # ========================================================================
    # AGENT360 CUSTOM PLUGINS
    # ========================================================================
    - name: Install plugin internal_server_metrics
      ansible.builtin.shell: |
        set -o pipefail
        curl -Ls {{ agent360_plugins_tgz_url }} | bash -s internal_server_metrics
      args:
        executable: /bin/bash
      register: plugin_internal
      changed_when: plugin_internal.rc == 0
      tags: [monitoring, plugins, stage1]

    - name: Install plugin vrrp_mon_cr
      ansible.builtin.shell: |
        set -o pipefail
        curl -Ls {{ agent360_plugins_deploy_url }} | bash -s vrrp_mon_cr
      args:
        executable: /bin/bash
      register: plugin_vrrp
      changed_when: plugin_vrrp.rc == 0
      tags: [monitoring, plugins, stage1]

    - name: Ensure pip3 is available
      ansible.builtin.package:
        name: python3-pip
        state: present
      tags: [monitoring, plugins, stage1]

    - name: Install mdjson Python package
      ansible.builtin.pip:
        name: mdjson
        executable: pip3
        state: present
      tags: [monitoring, plugins, stage1]

    - name: Install plugin mdstat_ls
      ansible.builtin.shell: |
        set -o pipefail
        curl -Ls {{ agent360_plugins_deploy_url }} | bash -s mdstat_ls
      args:
        executable: /bin/bash
      register: plugin_mdstat
      changed_when: plugin_mdstat.rc == 0
      tags: [monitoring, plugins, stage1]

    # ========================================================================
    # NBD MODULE + VIRTNBDBACKUP
    # ========================================================================
    - name: Ensure NBD module loads at boot
      ansible.builtin.copy:
        content: "nbd\n"
        dest: /etc/modules-load.d/nbd.conf
        mode: '0644'
      tags: [backup, nbd, prep, stage1]

    - name: Load NBD kernel module immediately
      community.general.modprobe:
        name: nbd
        state: present
      tags: [backup, nbd, prep, stage1]

    - name: Install virtnbdbackup
      ansible.builtin.shell: |
        set -o pipefail
        curl -s {{ virtnbdbackup_install_url }} | bash
      args:
        executable: /bin/bash
      register: virtnbd_install
      changed_when: virtnbd_install.rc == 0
      tags: [backup, virtnbd, stage1]
  handlers:
    - name: Mark swap as initialized
      ansible.builtin.file:
        path: "{{ swap_file_path }}.initialized"
        state: touch
        mode: '0644'

- name: Install backup agent
  hosts: kvm_node
  gather_facts: true
  vars:
    backup_manager_install_url: "https://backup-manager.stage.town/agents/install"
    backup_manager_add_node_url: "https://backup-manager.stage.town/hardwarenodes/"
  tasks:
    - name: Add hw node to backup manager
      ansible.builtin.uri:
        url: "{{ backup_manager_add_node_url }}"
        method: POST
        body_format: json
        body:
          name: "{{ inventory_hostname }}"
          ip: "{{ ansible_default_ipv4.address }}"
        headers:
          Content-Type: "application/json"
        status_code: 200
      tags: [backup, stage2]

    - name: Download backup-manager installer
      ansible.builtin.get_url:
        url: "{{ backup_manager_install_url }}"
        dest: /tmp/installer.sh
        mode: '0755'
        timeout: 30
      tags: [backup, backup-manager, stage2]

    - name: Run backup-manager installer (pass 1)
      ansible.builtin.shell: |
        set -o pipefail
        /tmp/installer.sh
      args:
        chdir: /tmp
      register: backup_install_1
      changed_when: backup_install_1.rc == 0
      tags: [backup, backup-manager, stage2]

- name: Generate ssh key
  hosts: kvm_node
  gather_facts: true
  vars:
    target_user: root
    local_tmp_path: "/tmp/id_rsa_host1.pub"
  tasks:
    - name: Generate SSH key pair
      community.crypto.openssh_keypair:
        path: "/{{ target_user }}/.ssh/id_rsa"
        type: rsa
        size: 2048
        comment: "ansible-generated-on-{{ ansible_fqdn }}"
      register: ssh_key_result
      tags: [stage2]
    - name: Fetch public key
      ansible.builtin.fetch:
        src: "/{{ target_user }}/.ssh/id_rsa.pub"
        dest: "{{ local_tmp_path }}"
        flat: true
      tags: [stage2]

- name: Upload key to storage server
  hosts: backup_node
  gather_facts: false
  vars:
    target_user: root
    local_tmp_path: "/tmp/id_rsa_host1.pub"
  tasks:
    - name: Install public key from local temp file
      ansible.posix.authorized_key:
        user: root
        state: present
        key: "{{ lookup('file', local_tmp_path) }}"
      tags: [stage2]
    - name: Remove temp file
      delegate_to: localhost
      run_once: true
      ansible.builtin.file:
        path: "{{ local_tmp_path }}"
        state: absent
      tags: [stage2]

- name: Create folder and file on backup node
  hosts: backup_node
  gather_facts: false
  vars:
    kvm_host: "{{ hostvars[groups['kvm_node'][0]]['inventory_hostname'] }}"
  tasks:
    - name: Create folder
      ansible.builtin.file:
        force: true
        path: "/vz/vmprivate/backups/{{ kvm_host }}"
        state: directory
        mode: '0755'
      tags: [stage2]
    - name: Create file
      ansible.builtin.file:
        force: true
        path: "/vz/vmprivate/backups/{{ kvm_host }}/mount-check-production.txt"
        state: touch
        mode: '0644'
      tags: [stage2]

- name: Get backups private ip
  hosts: backup_node
  gather_facts: true
  tasks:
    - name: Find the IP in the 10.10.10.0/21 range
      ansible.builtin.set_fact:
        private_ip: "{{ ansible_all_ipv4_addresses | select('match', '^10\\.10\\.10\\.') | first }}"
      tags: [stage2]

- name: Finish setup on kvm node
  hosts: kvm_node
  gather_facts: false
  vars:
    st_ip: "{{ hostvars[groups['backup_node'][0]]['private_ip'] }}"
  tasks:
    - name: Create folder on kvm node
      ansible.builtin.file:
        force: true
        path: "/vz/vmprivate/backups/{{ inventory_hostname }}"
        state: directory
        mode: '0755'
      tags: [stage2]
    - name: Add to fstab
      ansible.builtin.lineinfile:
        path: /etc/fstab
        regexp: '^root@.*:/vz/vmprivate/backups/{{ inventory_hostname }}'
        line: "root@{{ st_ip }}:/vz/vmprivate/backups/{{ inventory_hostname }} /vz/vmprivate/backups/{{ inventory_hostname }} fuse.sshfs rw,nosuid,reconnect,ServerAliveInterval=15,nodev,port=22,uid=0,gid=0 0 0"
        state: present
        validate: 'findmnt -T %s'
      tags: [stage2]
    - name: Reload systemd daemon to recognize fstab changes
      ansible.builtin.systemd:
        daemon_reload: yes
      tags: [stage2]
    - name: Ensure all filesystems in fstab are mounted
      ansible.builtin.mount:
        path: "/vz/vmprivate/backups/{{ inventory_hostname }}"
        state: mounted
        fstype: fuse.sshfs
      tags: [stage2]
    - name: Start and enable the backup-agent service
      ansible.builtin.service:
        name: backup-agent
        state: restarted
        enabled: true
      tags: [stage2_1]
    - name: Check backup-agent status
      ansible.builtin.command: service backup-agent status
      register: agent_status
      changed_when: false
      tags: [stage2_1]
    - name: Show backup-agent status result
      ansible.builtin.debug:
        var: agent_status.stdout_lines
      tags: [stage2_1]

        #    - name: Run backup-manager installer (pass 2)
        #      ansible.builtin.shell: |
        #        set -o pipefail
        #        /tmp/installer.sh
        #      args:
        #        chdir: /tmp
        #      register: backup_install_2
        #      changed_when: backup_install_2.rc == 0
        #      tags: [backup, backup-manager, stage2_1]

        #    - name: Run backup-manager mount script
        #      ansible.builtin.shell: |
        #        set -o pipefail
        #        /tmp/mount.sh
        #      args:
        #        chdir: /tmp
        #      register: backup_mount
        #      changed_when: backup_mount.rc == 0
        #      tags: [backup, backup-manager, stage2_1]

- name: Run final tests and report
  hosts: all
  gather_facts: true
  tasks:
    # ========================================================================
    # 10. goss ls tests
    # ========================================================================
    - name: Install ls-tests suite
      ansible.builtin.shell: |
        set -o pipefail
        curl -s {{ ls_tests_install_url }} | bash
      args:
        executable: /bin/bash
        creates: /opt/ls_tools/ls-tests/run_tests.sh
      register: ls_tests_install
      changed_when: ls_tests_install.rc == 0
      tags: [tests, ls-tests, stage3]

    - name: Run goss tests
      ansible.builtin.shell: |
        set -o pipefail
        /opt/ls_tools/ls-tests/run_tests.sh
      args:
        executable: /bin/bash
      register: ls_tests_run
      changed_when: ls_tests_run.rc == 0
      tags: [tests, ls-tests, stage3]

    # ========================================================================
    # 11. POST-INSTALL SUMMARY
    # ========================================================================
    - name: Display provisioning completion summary
      ansible.builtin.debug:
        msg: |
          ✅ SERVER PROVISIONING COMPLETE ✅
          Configuration applied:
          • Swap: {{ swap_file_path }} ({{ swap_file_size }}) → active
          • Timezone: {{ timezone }}
          • KernelCare: installed (license IP: {{ main_server_ip }})
          • Firewall360: {{ firewall_mode }} mode + reset
          • Agent360: monitoring + 3 plugins installed
          • NBD/virtnbdbackup: ready
          • backup-manager: installed + mounted
          Quick verification commands:
            swapon --show
            timedatectl
            systemctl status kcare
            firewall360 status
            agent360 status
            lsmod | grep nbd
      tags: [verify, always, stage3]