---
# Automated Raft snapshots via a systemd timer + a scoped periodic token.

- name: Write the snapshot policy (read raft snapshots only)
  ansible.builtin.command: "bao policy write snapshot -"
  args:
    stdin: "{{ lookup('template', 'snapshot-policy.hcl.j2') }}"
  environment: "{{ openbao_cli_env }}"
  register: snap_pol
  changed_when: snap_pol.rc == 0
  no_log: "{{ openbao_no_log }}"
  # Terraform owns this (../terraform). See openbao_config_managed_by_terraform.
  when: not openbao_config_managed_by_terraform | bool

- name: Check whether the snapshot token already exists
  ansible.builtin.stat:
    path: /etc/openbao/snapshot.token
  register: snap_tok_stat

- name: Create a periodic snapshot token (once)
  ansible.builtin.command: "bao token create -policy=snapshot -period=768h -orphan -field=token"
  environment: "{{ openbao_cli_env }}"
  register: snap_tok_new
  when: not snap_tok_stat.stat.exists
  changed_when: snap_tok_new.rc == 0
  no_log: true

- name: Store the snapshot token (root-only)
  ansible.builtin.copy:
    content: "{{ snap_tok_new.stdout }}"
    dest: /etc/openbao/snapshot.token
    owner: root
    group: root
    mode: "0600"
  when: not snap_tok_stat.stat.exists
  no_log: true

- name: Ensure the snapshot output directory exists
  ansible.builtin.file:
    path: "{{ openbao_snapshot_dir }}"
    state: directory
    owner: root
    group: root
    mode: "0700"

- name: Install the snapshot script
  ansible.builtin.template:
    src: bao-snapshot.sh.j2
    dest: /usr/local/bin/bao-snapshot.sh
    owner: root
    group: root
    mode: "0755"

- name: Install the snapshot systemd service + timer
  ansible.builtin.template:
    src: "{{ item }}.j2"
    dest: "/etc/systemd/system/{{ item }}"
    owner: root
    group: root
    mode: "0644"
  loop:
    - openbao-snapshot.service
    - openbao-snapshot.timer

- name: Enable and start the snapshot timer
  ansible.builtin.systemd:
    name: openbao-snapshot.timer
    state: started
    enabled: true
    daemon_reload: true