- name: Install requirements
  ansible.builtin.apt:
    name:
      - "unzip"

- name: Create Consul directory
  ansible.builtin.file:
    path: "/usr/local/consul-{{ consul_version }}"
    state: "directory"
    mode: "0755"

- name: Install Consul
  ansible.builtin.unarchive:
    src: "https://releases.hashicorp.com/consul/{{ consul_version }}/consul_{{ consul_version }}_linux_amd64.zip"
    dest: "/usr/local/consul-{{ consul_version }}"
    creates: "/usr/local/consul-{{ consul_version }}/consul"
    remote_src: true
  notify:
    - "Restart Consul"

- name: Create Consul system group
  ansible.builtin.group:
    name: "consul"
    system: true

- name: Create Consul system user
  ansible.builtin.user:
    name: "consul"
    group: "consul"
    groups: ["ssl-cert"]
    password: "!"
    system: true
    home: "/opt/consul"

- name: Create Consul config directory
  ansible.builtin.file:
    path: "/etc/consul"
    state: "directory"
    group: "consul"
    mode: "0750"

- name: Create Consul log dir
  ansible.builtin.file:
    path: "/var/log/consul"
    state: "directory"
    group: "consul"
    mode: "0770"

- name: Generate Consul config
  ansible.builtin.template:
    src: "templates/config.json"
    dest: "/etc/consul/config.json"
    group: "consul"
    mode: "0640"
  notify:
    - "Restart Consul"

- name: Deploy Consul service file
  ansible.builtin.template:
    src: "templates/consul.service"
    dest: "/etc/systemd/system/consul.service"
    mode: "0644"
  notify:
    - "Restart Consul"

- name: Enable and start Consul
  ansible.builtin.service:
    name: "consul"
    state: "started"
    enabled: true
    daemon_reload: true

- name: Generate Consul ACL config
  when: "consul_server"
  ansible.builtin.template:
    src: "templates/acl.json"
    dest: "/etc/consul/acl.json"
    group: "consul"
    mode: "0640"
  notify:
    - "Restart Consul"

- name: Running handlers for restarting Consul if required
  ansible.builtin.meta: "flush_handlers"

- name: Bootstrap Consul ACL system
  when: "consul_server"
  run_once: true
  community.general.consul_acl_bootstrap:
    bootstrap_secret: "{{ consul_bootstrap_secret }}"

- name: Create/retrieve Consul node agent accessor_id
  ansible.builtin.shell:
    executable: "/usr/bin/bash"
    cmd: |
      set -o pipefail
      if test -f /root/.consul_agent_accessor_id; then
        echo OK
      else
        uuidgen > /root/.consul_agent_accessor_id
        echo CHANGED
      fi
      cat /root/.consul_agent_accessor_id
  register: "consul_out_agent_accessor_id"
  changed_when: "consul_out_agent_accessor_id.stdout_lines[0] == 'CHANGED'"

- name: Create/retrieve Consul node agent token
  community.general.consul_token:
    token: "{{ consul_bootstrap_secret }}"
    accessor_id: "{{ consul_out_agent_accessor_id.stdout_lines[1] }}"
    description: "Node {{ ansible_fqdn }}"
    node_identities:
      - datacenter: "{{ consul_datacenter }}"
        node_name: "{{ ansible_hostname }}"
  register: "consul_out_agent_token"

- name: Create Consul policy for DNS agent
  when: "consul_server"
  run_once: true
  community.general.consul_policy:
    token: "{{ consul_bootstrap_secret }}"
    name: "dns-access"
    rules: |
      node_prefix "" {
        policy = "read"
      }
      {% for service in consul_services %}
      service "{{ service.name }}" {
        policy = "read"
      }
      {% endfor %}

- name: Create/retrieve Consul DNS agent accessor_id
  ansible.builtin.shell:
    executable: "/usr/bin/bash"
    cmd: |
      set -o pipefail
      if test -f /root/.consul_dns_accessor_id; then
        echo OK
      else
        uuidgen > /root/.consul_dns_accessor_id
        echo CHANGED
      fi
      cat /root/.consul_dns_accessor_id
  register: "consul_out_dns_accessor_id"
  changed_when: "consul_out_dns_accessor_id.stdout_lines[0] == 'CHANGED'"

- name: Create/retrieve Consul DNS agent token
  when: "consul_server"
  community.general.consul_token:
    token: "{{ consul_bootstrap_secret }}"
    accessor_id: "{{ consul_out_dns_accessor_id.stdout_lines[1] }}"
    description: "DNS {{ ansible_fqdn }}"
    policies:
      - name: "dns-access"
  register: "consul_out_dns_token"

- name: Generate Consul agent tokens config
  ansible.builtin.template:
    src: "templates/tokens.json"
    dest: "/etc/consul/tokens.json"
    group: "consul"
    mode: "0640"
  notify:
    - "Restart Consul"

- name: Running handlers for restarting Consul if required
  ansible.builtin.meta: "flush_handlers"

- name: Create Consul policy for UI
  when: "consul_server and consul_ui_secret_id != None"
  run_once: true
  community.general.consul_policy:
    token: "{{ consul_bootstrap_secret }}"
    name: "ui-access"
    rules: |
      key_prefix "" {
        policy = "write"
      }
      node_prefix "" {
        policy = "read"
      }
      service_prefix "" {
        policy = "read"
      }

- name: Create/retrieve Consul UI accessor_id
  when: "consul_server and consul_ui_secret_id != None and consul_servers[0] == ansible_hostname"
  ansible.builtin.shell:
    executable: "/usr/bin/bash"
    cmd: |
      set -o pipefail
      if test -f /root/.consul_ui_accessor_id; then
        echo OK
      else
        uuidgen > /root/.consul_ui_accessor_id
        echo CHANGED
      fi
      cat /root/.consul_ui_accessor_id
  register: "consul_out_ui_accessor_id"
  changed_when: "consul_out_ui_accessor_id.stdout_lines[0] == 'CHANGED'"

- name: Create/retrieve Consul UI token
  when: "consul_server and consul_ui_secret_id != None and consul_servers[0] == ansible_hostname"
  community.general.consul_token:
    token: "{{ consul_bootstrap_secret }}"
    accessor_id: "{{ consul_out_ui_accessor_id.stdout_lines[1] }}"
    secret_id: "{{ consul_ui_secret_id }}"
    description: "UI"
    policies:
      - name: "ui-access"

- name: Register services to consul
  loop: "{{ consul_services }}"
  community.general.consul_agent_service:
    token: "{{ consul_bootstrap_secret }}"
    name: "{{ item.name }}"
    address: "{{ item.address | default(ansible_default_ipv4.address) }}"
    service_port: "{{ item.port }}"
    tags: "{{ item.tags | default([]) }}"
  # Because community.general.consul_agent_check is not idempotent:
  register: "consul_out_register_services"

- name: Register HTTP checks to consul
  loop: "{{ consul_services }}"
  when: "consul_out_register_services.changed and (item.check_http | default(None) != None)"
  community.general.consul_agent_check:
    token: "{{ consul_bootstrap_secret }}"
    name: "{{ item.name }}_check"
    service_id: "{{ item.name }}"
    interval: "{{ item.check_interval | default(consul_default_check_interval) }}"
    timeout: "{{ item.check_timeout | default(consul_default_check_timeout) }}"
    http: "{{ item.check_http }}"
    scheme: "{{ item.check_scheme | default('http') }}"

- name: Register TCP checks to consul
  loop: "{{ consul_services }}"
  when: "consul_out_register_services and (item.check_tcp | default(None) != None)"
  community.general.consul_agent_check:
    token: "{{ consul_bootstrap_secret }}"
    name: "{{ item.name }}_check"
    service_id: "{{ item.name }}"
    interval: "{{ item.check_interval | default(consul_default_check_interval) }}"
    timeout: "{{ item.check_timeout | default(consul_default_check_timeout) }}"
    tcp: "{{ item.check_tcp }}"