---
- name: Set binary app derived values
  ansible.builtin.set_fact:
    binary_app_install_root: "{{ binary_app.install_root | default('/opt/' ~ binary_app.name) }}"
    binary_app_release_dir: "{{ binary_app.install_root | default('/opt/' ~ binary_app.name) }}/releases/{{ binary_app.version }}"
    binary_app_current_path: "{{ binary_app.install_root | default('/opt/' ~ binary_app.name) }}/current"
    binary_app_checksum_asset_name: "{{ binary_app.checksum_asset_name | default(binary_app.asset_name ~ '.sha256') }}"
    binary_app_binary_path: "{{ binary_app.binary_path | default(binary_app.binary_name) }}"

- name: Ensure binary app group exists
  ansible.builtin.group:
    name: "{{ binary_app.deploy_group }}"
    state: present

- name: Ensure binary app user exists
  ansible.builtin.user:
    name: "{{ binary_app.deploy_user }}"
    group: "{{ binary_app.deploy_group }}"
    system: true
    shell: /usr/sbin/nologin
    create_home: true

- name: Ensure binary app directories exist
  ansible.builtin.file:
    path: "{{ item.path }}"
    state: directory
    owner: "{{ item.owner }}"
    group: "{{ item.group }}"
    mode: "{{ item.mode }}"
  loop:
    - path: "{{ binary_app_install_root }}"
      owner: root
      group: root
      mode: "0755"
    - path: "{{ binary_app_install_root }}/releases"
      owner: root
      group: root
      mode: "0755"
    - path: "{{ binary_app_release_dir }}"
      owner: root
      group: root
      mode: "0755"
    - path: "/var/lib/{{ binary_app.name }}"
      owner: "{{ binary_app.deploy_user }}"
      group: "{{ binary_app.deploy_group }}"
      mode: "0755"
    - path: "/etc/{{ binary_app.name }}"
      owner: root
      group: "{{ binary_app.deploy_group }}"
      mode: "0750"
  loop_control:
    label: "{{ item.path }}"

- name: Ensure binary app extra directories exist
  ansible.builtin.file:
    path: "{{ item.path }}"
    state: directory
    owner: "{{ item.owner | default(binary_app.deploy_user) }}"
    group: "{{ item.group | default(binary_app.deploy_group) }}"
    mode: "{{ item.mode | default('0755') }}"
  loop: "{{ binary_app.extra_directories | default([]) }}"
  loop_control:
    label: "{{ item.path }}"

- name: Remove legacy Bun deploy key
  ansible.builtin.file:
    path: "/etc/{{ binary_app.name }}/deploy_key"
    state: absent
  when: binary_app.remove_legacy_deploy_key | default(false) | bool

- name: Look up binary app GitHub release
  ansible.builtin.uri:
    url: "https://api.github.com/repos/{{ binary_app.github_repo }}/releases/tags/{{ binary_app.version }}"
    headers: >-
      {{
        {
          'Accept': 'application/vnd.github+json',
          'X-GitHub-Api-Version': '2022-11-28'
        }
        | combine(
          {'Authorization': 'Bearer ' ~ binary_app.github_token}
          if (binary_app.github_token | default('') | length > 0)
          else {}
        )
      }}
    return_content: true
    status_code: 200
  register: binary_app_github_release
  no_log: "{{ binary_app.github_token | default('') | length > 0 }}"

- name: Find binary app GitHub release assets
  ansible.builtin.set_fact:
    binary_app_asset_matches: "{{ binary_app_github_release.json.assets | selectattr('name', 'equalto', binary_app.asset_name) | list }}"
    binary_app_checksum_asset_matches: "{{ binary_app_github_release.json.assets | selectattr('name', 'equalto', binary_app_checksum_asset_name) | list }}"

- name: Validate binary app GitHub release assets
  ansible.builtin.assert:
    that:
      - binary_app_asset_matches | length == 1
      - binary_app_checksum_asset_matches | length == 1
    fail_msg: "Release {{ binary_app.version }} for {{ binary_app.github_repo }} must contain {{ binary_app.asset_name }} and {{ binary_app_checksum_asset_name }}."

- name: Set binary app GitHub release asset API URLs
  ansible.builtin.set_fact:
    binary_app_asset_api_url: "{{ binary_app_asset_matches[0].url }}"
    binary_app_checksum_asset_api_url: "{{ binary_app_checksum_asset_matches[0].url }}"

- name: Download binary app checksum
  ansible.builtin.command:
    argv: >-
      {{
        [
          'curl',
          '--fail',
          '--location',
          '--silent',
          '--show-error',
          '--header',
          'Accept: application/octet-stream',
          '--header',
          'X-GitHub-Api-Version: 2022-11-28'
        ]
        + (
          ['--header', 'Authorization: Bearer ' ~ binary_app.github_token]
          if (binary_app.github_token | default('') | length > 0)
          else []
        )
        + [
          '--output',
          binary_app_release_dir ~ '/' ~ binary_app_checksum_asset_name,
          binary_app_checksum_asset_api_url
        ]
      }}
    creates: "{{ binary_app_release_dir }}/{{ binary_app_checksum_asset_name }}"
  no_log: "{{ binary_app.github_token | default('') | length > 0 }}"

- name: Ensure binary app checksum file permissions
  ansible.builtin.file:
    path: "{{ binary_app_release_dir }}/{{ binary_app_checksum_asset_name }}"
    owner: root
    group: root
    mode: "0644"

- name: Download binary app release archive
  ansible.builtin.command:
    argv: >-
      {{
        [
          'curl',
          '--fail',
          '--location',
          '--silent',
          '--show-error',
          '--header',
          'Accept: application/octet-stream',
          '--header',
          'X-GitHub-Api-Version: 2022-11-28'
        ]
        + (
          ['--header', 'Authorization: Bearer ' ~ binary_app.github_token]
          if (binary_app.github_token | default('') | length > 0)
          else []
        )
        + [
          '--output',
          binary_app_release_dir ~ '/' ~ binary_app.asset_name,
          binary_app_asset_api_url
        ]
      }}
    creates: "{{ binary_app_release_dir }}/{{ binary_app.asset_name }}"
  register: binary_app_archive
  no_log: "{{ binary_app.github_token | default('') | length > 0 }}"

- name: Ensure binary app release archive permissions
  ansible.builtin.file:
    path: "{{ binary_app_release_dir }}/{{ binary_app.asset_name }}"
    owner: root
    group: root
    mode: "0644"

- name: Verify binary app release archive checksum
  ansible.builtin.command:
    argv:
      - sha256sum
      - -c
      - "{{ binary_app_checksum_asset_name }}"
    chdir: "{{ binary_app_release_dir }}"
  changed_when: false

- name: Unpack binary app release archive
  ansible.builtin.unarchive:
    src: "{{ binary_app_release_dir }}/{{ binary_app.asset_name }}"
    dest: "{{ binary_app_release_dir }}"
    remote_src: true
    owner: root
    group: root
    mode: "0755"
    creates: "{{ binary_app_release_dir }}/{{ binary_app_binary_path }}"
  register: binary_app_unpack

- name: Ensure binary app executable permissions
  ansible.builtin.file:
    path: "{{ binary_app_release_dir }}/{{ binary_app_binary_path }}"
    owner: root
    group: root
    mode: "0755"

- name: Point binary app current symlink at selected release
  ansible.builtin.file:
    src: "{{ binary_app_release_dir }}"
    dest: "{{ binary_app_current_path }}"
    state: link
    force: true
  register: binary_app_current

- name: Render binary app environment file
  ansible.builtin.template:
    src: binary-app.env.j2
    dest: "/etc/{{ binary_app.name }}/app.env"
    owner: root
    group: "{{ binary_app.deploy_group }}"
    mode: "0640"
  register: binary_app_env

- name: Install binary app systemd unit
  ansible.builtin.template:
    src: binary-app.service.j2
    dest: "/etc/systemd/system/{{ binary_app.service_name }}.service"
    owner: root
    group: root
    mode: "0644"
  register: binary_app_unit

- name: Reload systemd for binary app changes
  ansible.builtin.systemd_service:
    daemon_reload: true
  when: binary_app_unit.changed

- name: Ensure binary app service is enabled and running
  ansible.builtin.service:
    name: "{{ binary_app.service_name }}"
    state: >-
      {{
        'restarted'
        if (
          binary_app_archive.changed
          or binary_app_unpack.changed
          or binary_app_current.changed
          or binary_app_env.changed
          or binary_app_unit.changed
        )
        else 'started'
      }}
    enabled: true