---
- name: Deploy LubeLogger on docker-node01
  hosts: docker-node01
  become: true
  vars:
    app_dir: /home/tommy/lubelogger
    app_port: 8099

  tasks:
    - name: Create lubelogger directory
      ansible.builtin.file:
        path: "{{ app_dir }}"
        state: directory
        owner: tommy
        group: tommy
        mode: "0755"

    - name: Write docker-compose.yml
      ansible.builtin.copy:
        dest: "{{ app_dir }}/docker-compose.yml"
        owner: tommy
        group: tommy
        mode: "0644"
        content: |
          # lubelogger - Vehicle & small-engine maintenance tracker
          # Host: docker-node01 (.186), Port: {{ app_port }}
          # Traefik: lubelogger.goattw.net (Authelia protected, @file router -> :{{ app_port }})
          # Backend: PostgreSQL 18 (tables live in the `app` schema).
          # In-app auth is ENABLED (root user) - the published host port is safe.
          # Do NOT lose the lubelogger-keys volume (ASP.NET DataProtection keyring).

          services:
            lubelogger:
              image: ghcr.io/hargata/lubelogger:v1.6.8
              container_name: lubelogger
              restart: unless-stopped
              depends_on:
                - lubelogger-db
              ports:
                - "{{ app_port }}:8080"
              environment:
                TZ: America/Chicago
                LUBELOGGER_LOCALE_OVERRIDE: "en_US"
                POSTGRES_CONNECTION: "Host=lubelogger-db:5432;Username=lubelogger;Password={{ vault_lubelogger_db_password }};Database=lubelogger;"
              volumes:
                - lubelogger-data:/App/data
                - lubelogger-keys:/root/.aspnet/DataProtection-Keys
              networks:
                - lubelogger-int
              labels:
                - "docker-volume-backup.stop-during-backup=true"
                # Diun watches by default (digest); watch_repo + semver filter
                # so a NEW release tag (e.g. v1.6.9) pings the existing Diun->HA pipeline.
                - "diun.enable=true"
                - "diun.watch_repo=true"
                - 'diun.include_tags=^v[0-9]+\.[0-9]+\.[0-9]+$'

            lubelogger-db:
              image: postgres:18
              container_name: lubelogger-db
              restart: unless-stopped
              environment:
                POSTGRES_USER: lubelogger
                POSTGRES_PASSWORD: "{{ vault_lubelogger_db_password }}"
                POSTGRES_DB: lubelogger
                TZ: America/Chicago
              volumes:
                - lubelogger-db:/var/lib/postgresql
                - /etc/localtime:/etc/localtime:ro
              networks:
                - lubelogger-int
              healthcheck:
                test: ["CMD-SHELL", "pg_isready -U lubelogger -d lubelogger"]
                interval: 10s
                timeout: 5s
                retries: 5
                start_period: 30s
              labels:
                - "docker-volume-backup.stop-during-backup=true"

          networks:
            lubelogger-int:
              driver: bridge

          volumes:
            lubelogger-data:
            lubelogger-keys:
            lubelogger-db:

    - name: Remove stale .env (secret now sourced from ansible-vault)
      ansible.builtin.file:
        path: "{{ app_dir }}/.env"
        state: absent

    - name: Deploy lubelogger with docker compose
      community.docker.docker_compose_v2:
        project_src: "{{ app_dir }}"
        state: present
        pull: missing
      register: app_result

    - name: Show deployment result
      ansible.builtin.debug:
        msg: "lubelogger is {{ 'running (changed)' if app_result.changed else 'already up (no-op)' }} on port {{ app_port }}"