---
- name: Install dependencies for authentik
  xbps:
    pkg:
      - podman
      - python3-dnspython
      - python3-psycopg2
    state: present

- name: add dns entry
  community.general.nsupdate:
    key_name: "ansible"
    key_secret: "{{ dns_tsig_key }}"
    key_algorithm: "hmac-sha512"
    server: "127.0.0.1"
    zone: "cosmosim.dev"
    record: "{{ zitadel_domain }}."
    type: "CNAME"
    value: "{{ inventory_hostname }}."
    state: present

- name: Create authentik user
  ansible.builtin.user:
    name: authentik
    state: present
    createhome: true

- name: Create postgres role
  community.postgresql.postgresql_user:
    name: "{{ authentik_db_user }}"
    state: present
    password: "{{ authentik_db_pass }}"
  become: true
  become_user: postgres

- name: Create postgres database
  community.postgresql.postgresql_db:
    name: "{{ authentik_db_name }}"
    owner: "{{ authentik_db_user }}"
    state: present
  become: true
  become_user: postgres

- name: Create podman network
  containers.podman.podman_network:
    name: authentik
  become: true
  become_user: authentik

- name: Create runtime directory
  ansible.builtin.file:
    path: /home/authentik/{{ item }}
    owner: authentik
    group: authentik
    mode: "0775"
    state: directory
  with_items:
    - data
    - certs
    - custom-templates

- name: Upload configuration
  ansible.builtin.template:
    src: templates/conf.j2
    dest: /etc/authentik.env
    owner: root
    group: authentik
    mode: "0640"
  notify:
    - Restart authentik-server
    - Restart authentik-worker

- name: Install Service (1/3)
  ansible.builtin.file:
    path: /etc/sv/{{item}}
    state: directory
    owner: root
    group: root
    mode: "0755"
  with_items:
    - authentik-server
    - authentik-server/log
    - authentik-worker
    - authentik-worker/log

- name: Install Service (2/3)
  ansible.builtin.template:
    src: authentik.run.j2
    dest: /etc/sv/authentik-{{ item }}/run
    owner: root
    group: root
    mode: "0755"
  notify:
    - Restart authentik-server
    - Restart authentik-worker
  with_items:
    - worker
    - server

- name: Install Service (3/3)
  ansible.builtin.template:
    src: "log.run.j2"
    dest: "/etc/sv/{{ item }}/log/run"
    owner: root
    group: root
    mode: "0755"
  with_items:
    - authentik-server
    - authentik-worker

- name: Enable services
  runit:
    name: "{{ item }}"
    enabled: true
  with_items:
    - authentik-server
    - authentik-worker