---
- name: prepare storage volume
  vars:
    storage_volume: "{{ node_red_instances[node_red_instance].storage }}"
  include_role:
    name: "storage/{{ node_red_instances[node_red_instance].storage.type }}/volume"

- set_fact:
    node_red_instance_basepath: "{{ storage_volume_mountpoint }}"

- name: create instance directories
  loop:
  - data
  - tls
  file:
    path: "{{ node_red_instance_basepath }}/{{ item }}"
    state: directory
    owner: 1000
    mode: 0700

- name: generate/install/fetch TLS certificates for mqtt
  when: "'mqtt_tls' in node_red_instances[node_red_instance]"
  vars:
    x509_certificate_name: "node-red-{{ node_red_instance }}_mqtt"
    x509_certificate_hostnames: []
    x509_certificate_config: "{{ node_red_instances[node_red_instance].mqtt_tls.certificate_config }}"
    x509_certificate_renewal:
      install:
      - dest: "{{ node_red_instance_basepath }}/tls/mqtt-crt.pem"
        src:
        - fullchain
        owner: root
        group: 1000
        mode: "0644"
      - dest: "{{ node_red_instance_basepath }}/tls/mqtt-key.pem"
        src:
        - key
        owner: root
        group: 1000
        mode: "0640"
      - dest: "{{ node_red_instance_basepath }}/tls/mqtt-ca-crt.pem"
        src:
        - ca_cert
        owner: root
        group: 1000
        mode: "0644"
  include_role:
    name: "x509/{{ node_red_instances[node_red_instance].mqtt_tls.certificate_provider }}/cert"

- name: generate/install TLS certificates for publishment
  vars:
    x509_certificate_name: "node-red-{{ node_red_instance }}_publish"
    x509_certificate_hostnames: []
    x509_certificate_config:
      ca: "{{ node_red_instances[node_red_instance].publish.zone.certificate_ca_config }}"
      cert:
        common_name: "node-red-{{ node_red_instance }}.{{ inventory_hostname }}"
        extended_key_usage:
        - serverAuth
        extended_key_usage_critical: yes
        create_subject_key_identifier: yes
        not_after: +100w
    x509_certificate_renewal:
      install:
      - dest: "{{ node_red_instance_basepath }}/tls/publish-crt.pem"
        src:
        - fullchain
        owner: root
        group: 1000
        mode: "0644"
      - dest: "{{ node_red_instance_basepath }}/tls/publish-key.pem"
        src:
        - key
        owner: root
        group: 1000
        mode: "0640"
      - dest: "{{ node_red_instance_basepath }}/tls/publish-ca-crt.pem"
        src:
        - ca_cert
        owner: root
        group: 1000
        mode: "0644"
  include_role:
    name: "x509/{{ node_red_instances[node_red_instance].publish.zone.certificate_provider }}/cert"

- name: build custom image
  when: "'custom_image' in node_red_instances[node_red_instance]"
  block:
  - name: create build directory for custom image
    file:
      path: "{{ node_red_instance_basepath }}/build"
      state: directory

  - name: generate Dockerfile for custom image
    copy:
      content: |
        FROM {{ node_red_instances[node_red_instance].custom_image.from | default('nodered/node-red:' + node_red_instances[node_red_instance].version + '-debian') }}

        {{ node_red_instances[node_red_instance].custom_image.dockerfile }}
      dest: "{{ node_red_instance_basepath }}/build/Dockerfile"
    register: node_red_custom_image_docker

  - name: build custom image
    docker_image:
      name: "nodered/node-red/{{ node_red_instance }}:{{ node_red_instances[node_red_instance].version }}-debian"
      state: present
      force_source: "{{ node_red_custom_image_docker is changed }}"
      source: build
      build:
        path: "{{ node_red_instance_basepath }}/build"
        network: host
        pull: yes

- name: test if settings.js already exists
  stat:
    path: "{{ node_red_instance_basepath }}/data/settings.js"
  register: node_red_settings_js

- name: install pod manifest
  vars:
    kubernetes_standalone_pod:
      name: "node-red-{{ node_red_instance }}"
      spec: "{{ lookup('template', 'pod-spec.yml.j2') }}"
  include_role:
    name: kubernetes/standalone/pod

- name: configure nginx vhost for publishment
  vars:
    nginx_vhost__yaml: |
      name: "node-red-{{ node_red_instance }}.{{ inventory_hostname }}"
      template: generic
      {% if 'tls' in node_red_instances[node_red_instance].publish %}
      tls:
        {{ node_red_instances[node_red_instance].publish.tls | to_nice_yaml(indent=2) | indent(2) }}
      {% endif %}
      hostnames:
      {% for hostname in node_red_instances[node_red_instance].publish.hostnames %}
      - {{ hostname }}
      {% endfor %}
      locations:
        '/':
      {% if node_red_instances[node_red_instance].publish.zone.publisher == inventory_hostname %}
          proxy_pass: "https://127.0.0.1:{{ node_red_instances[node_red_instance].port }}"
      {% else %}
          proxy_pass: "https://{{ ansible_default_ipv4.address }}:{{ node_red_instances[node_red_instance].port }}"
      {% endif %}
          proxy_ssl:
            certificate: "/etc/ssl/apps-publish-{{ node_red_instances[node_red_instance].publish.zone.name }}/apps-publish-{{ node_red_instances[node_red_instance].publish.zone.name }}-crt.pem"
            certificate_key: "/etc/ssl/apps-publish-{{ node_red_instances[node_red_instance].publish.zone.name }}/apps-publish-{{ node_red_instances[node_red_instance].publish.zone.name }}-key.pem"
            trusted_certificate: "/etc/ssl/apps-publish-{{ node_red_instances[node_red_instance].publish.zone.name }}/apps-publish-{{ node_red_instances[node_red_instance].publish.zone.name }}-ca-crt.pem"
            verify: "on"
            name: "node-red-{{ node_red_instance }}.{{ inventory_hostname }}"
            protocols: "TLSv1.3"
      {% if 'location_extra_directives' in node_red_instances[node_red_instance].publish %}
          extra_directives: |
            {{ node_red_instances[node_red_instance].publish.location_extra_directives | indent(6) }}
      {% endif %}
      {% if 'vhost_extra_directives' in node_red_instances[node_red_instance].publish %}
      extra_directives: |
        {{ node_red_instances[node_red_instance].publish.vhost_extra_directives | indent(2) }}
      {% endif %}
    nginx_vhost: "{{ nginx_vhost__yaml | from_yaml }}"
  include_role:
    name: nginx/vhost
    apply:
      delegate_to: "{{ node_red_instances[node_red_instance].publish.zone.publisher }}"


- name: print info for new instance
  when: not node_red_settings_js.stat.exists
  pause:
    seconds: 5
    prompt: |
      ************* {{ node_red_instance }} is a new instance
      **
      **  Wait for default settings.js to be populated and then add the following options:

          credentialSecret: "{{ node_red_instances[node_red_instance].credential_secret }}",

          https: {
            key: require("fs").readFileSync('/tls/publish-key.pem'),
            cert: require("fs").readFileSync('/tls/publish-crt.pem'),
            ca: require("fs").readFileSync('/tls/publish-ca-crt.pem'),
            requestCert: true,
            minVersion: 'TLSv1.3'
          },
          {% if 'extra_settings' in node_red_instances[node_red_instance] %}

          {{ node_red_instances[node_red_instance].extra_settings | indent(4) }}
          {% endif %}

      **
      ****************************************