---
# 仅在 Terraform 身份配置完成后部署；预检失败不启用定时器。
- name: 安装独立于人工会话的续签调度
  hosts: etcd-laptop
  become: true
  gather_facts: false
  tasks:
    - name: 创建 root 管理的程序目录
      ansible.builtin.file:
        path: /opt/homelab-etcd-controller
        state: directory
        mode: '0755'
    - name: 安装证书登录与调度程序
      ansible.builtin.copy:
        src: "../controller/{{ item }}"
        dest: "/opt/homelab-etcd-controller/{{ item }}"
        owner: root
        group: root
        mode: '0755'
      loop: [login.py, renew.py]
    - name: 以机器身份预检（不输出 token）
      ansible.builtin.command:
        argv: [/usr/bin/python3, /opt/homelab-etcd-controller/login.py]
      changed_when: false
      no_log: true
    - name: 安装固定的 Ansible 配置副本
      ansible.builtin.copy:
        src: "{{ playbook_dir }}/"
        dest: /opt/homelab-etcd-controller/ansible/
        owner: root
        group: root
        mode: preserve
    - name: 创建调度状态目录
      ansible.builtin.file:
        path: /var/lib/homelab-etcd-controller
        state: directory
        owner: panxiao81
        group: panxiao81
        mode: '0700'
    - name: 安装续签 oneshot unit
      ansible.builtin.copy:
        dest: /etc/systemd/system/homelab-etcd-renew.service
        mode: '0644'
        content: |
          [Unit]
          Description=Renew shared etcd certificates through Bao machine identity
          After=network-online.target
          [Service]
          Type=oneshot
          User=panxiao81
          Environment=HOME=/home/panxiao81
          Environment=PATH=/home/panxiao81/.local/bin:/usr/local/bin:/usr/bin:/bin
          ExecStart=/usr/bin/python3 /opt/homelab-etcd-controller/renew.py
          TimeoutStartSec=30min
          UMask=0077
    - name: 安装每日续签 timer
      ansible.builtin.copy:
        dest: /etc/systemd/system/homelab-etcd-renew.timer
        mode: '0644'
        content: |
          [Unit]
          Description=Daily shared etcd certificate renewal check
          [Timer]
          OnCalendar=*-*-* 04:10:00 UTC
          RandomizedDelaySec=15min
          Persistent=true
          [Install]
          WantedBy=timers.target
    - name: 启用续签调度
      ansible.builtin.systemd_service:
        name: homelab-etcd-renew.timer
        daemon_reload: true
        enabled: true
        state: started