---
# Automated Raft snapshots via a systemd timer + a scoped periodic token.

- name: Write the snapshot policy (read raft snapshots only)
  ansible.builtin.command: "bao policy write snapshot -"
  args:
    stdin: "{{ lookup('template', 'snapshot-policy.hcl.j2') }}"
  environment: "{{ openbao_cli_env }}"
  register: snap_pol
  changed_when: snap_pol.rc == 0
  no_log: "{{ openbao_no_log }}"
  # Terraform owns this (../terraform). See openbao_config_managed_by_terraform.
  when: not openbao_config_managed_by_terraform | bool

- name: Check whether the snapshot token already exists
  ansible.builtin.stat:
    path: /etc/openbao/snapshot.token
  register: snap_tok_stat

- name: Create or explicitly rotate the periodic snapshot token
  ansible.builtin.command: "bao token create -policy=snapshot -period=768h -orphan -field=token"
  environment: "{{ openbao_cli_env }}"
  register: snap_tok_new
  when: (not snap_tok_stat.stat.exists) or (openbao_snapshot_rotate_token | bool)
  changed_when: snap_tok_new.rc == 0
  no_log: true

- name: Store the snapshot token (root-only)
  ansible.builtin.copy:
    content: "{{ snap_tok_new.stdout }}"
    dest: /etc/openbao/snapshot.token
    owner: root
    group: root
    mode: "0600"
  when: (not snap_tok_stat.stat.exists) or (openbao_snapshot_rotate_token | bool)
  no_log: true

- name: 安装独立的主机与快照指标 exporter
  ansible.builtin.include_role:
    name: openbao_monitoring

- name: 部署快照脚本和定时器
  ansible.builtin.import_tasks: snapshot-runtime.yml