---
- name: make sure sync client config directory exists
  file:
    path: "/etc/whawty/auth/.store-{{ item.key }}-sync"
    state: directory

- name: generate ssh config for whawty-auth store sync client
  copy:
    content: |
      Host whawty-auth-server
      Hostname {{ item.value.sync.hostname }}
      {% if 'port' in item.value.sync %}
      Port {{ item.value.sync.port }}
      {% endif %}
      User {{ item.value.sync.user }}
      IdentityFile /etc/whawty/auth/.store-{{ item.key }}-sync/id_ed25519
      IdentitiesOnly yes
      UserKnownHostsFile /etc/whawty/auth/.store-{{ item.key }}-sync/known_hosts
      ControlMaster auto
      ControlPath /run/ssh-master.whawty-auth-store-sync-{{ item.key }}
      ControlPersist 300
    dest: "/etc/whawty/auth/.store-{{ item.key }}-sync/ssh_config"

- name: generate ssh keypair for sync client
  openssh_keypair:
    path: /etc/whawty/auth/.store-{{ item.key }}-sync/id_ed25519
    type: ed25519
    comment: "whawty-auth-sync-{{ item.key }}@{{ inventory_hostname }}"

- name: generate sync script
  copy:
    content: |
      #!/bin/bash
      {% set rsync_args = [] %}
      {% if 'permissions' in item.value %}
      {%   if 'file-mode' in item.value.permissions %}
      {%     set _dummy = rsync_args.append(" --chmod=F"~item.value.permissions['file-mode']) %}
      {%   endif %}
      {%   if 'owner' in item.value.permissions %}
      {%     set _dummy = rsync_args.append(" --chown="~item.value.permissions.owner~":"~item.value.permissions.group) %}
      {%   endif %}
      {% endif %}
      while true; do
        /usr/bin/rsync -rtWi --delete --delete-delay --delay-updates --partial-dir=.tmp{{ rsync_args | join('') }} -e 'ssh -F "/etc/whawty/auth/.store-{{ item.key }}-sync/ssh_config"' 'rsync://whawty-auth-server/store' '{{ item.value.config.basedir }}'
      {% if (item.value.sync.prometheus | default(False)) %}
        result=$?
        now=$(date +"%s")
        cat <<EOF | sponge /var/lib/prometheus-node-exporter/textfile-collector/whawty-auth-store-sync-{{ item.key }}.prom
      whawty_auth_store_sync_run{name="{{ item.key }}"} $now
      whawty_auth_store_sync_exit_code{name="{{ item.key }}"} $result
      EOF
      {% endif %}
        sleep 60
      done
    dest: /etc/whawty/auth/.store-{{ item.key }}-sync/run.sh
    mode: 0755

- name: generate known_hosts file
  shell: "ssh-keyscan{% if 'port' in item.value.sync %} -p {{ item.value.sync.port }}{% endif %} {{ item.value.sync.hostname }} > /etc/whawty/auth/.store-{{ item.key }}-sync/known_hosts"
  args:
    creates: "/etc/whawty/auth/.store-{{ item.key }}-sync/known_hosts"

- name: install systemd units for whawty-auth store sync client
  template:
    src: "systemd.service.j2"
    dest: "/etc/systemd/system/whawty-auth-store-sync-{{ item.key }}.service"

- name: make sure whawty-auth store sync client is enabled and started
  systemd:
    daemon_reload: yes
    name: "whawty-auth-store-sync-{{ item.key }}.service"
    state: started
    enabled: yes