---
- name: Validate the explicitly selected development host and TLS binding
  ansible.builtin.assert:
    that:
      - (ansible_facts.distribution == 'Debian' and ansible_facts.distribution_major_version == '12') or ansible_facts.distribution == 'Fedora'
      - edge_tls == '/opt/pharos-local-aai/tls'
  tags: [platform-edge-plan]

- name: Find the laboratory routes registered on this host
  ansible.builtin.find:
    paths: '{{ edge_extensions }}'
    patterns: '*.yaml'
  register: edge_registered
  tags: [platform-edge-plan]

- name: Read the registered laboratory routes
  ansible.builtin.slurp:
    src: '{{ item.path }}'
  loop: '{{ edge_registered.files }}'
  register: edge_registered_routes
  tags: [platform-edge-plan]

# The caller's routes file replaces its earlier registration.
- name: Combine the registered routes with the caller's
  ansible.builtin.set_fact:
    edge_extension_set: >-
      {{ dict(edge_values_list | map(attribute='name') | zip(edge_values_list)) | dict2items
         | map(attribute='value') | list }}
  vars:
    edge_values_list: >-
      {{ edge_registered_routes.results | map(attribute='content') | map('b64decode') | map('from_yaml') | list
         + ([lookup('ansible.builtin.file', edge_extension) | from_yaml] if edge_extension else []) }}
  tags: [platform-edge-plan]

- name: Load the committed service catalogue
  ansible.builtin.include_vars:
    file: '{{ edge_catalogue }}'
    name: edge_services
  tags: [platform-edge-plan]

- name: Load the environment values
  ansible.builtin.include_vars:
    file: '{{ edge_environment }}'
    name: edge_values
  tags: [platform-edge-plan]

- name: Validate and resolve routes in the controller before changing the host
  ansible.builtin.command:
    argv: >-
      {{ [ansible_playbook_python, edge_controller + '/catalogue.py',
          '--catalogue', edge_catalogue, '--environment', edge_environment, '--extensions', '-']
          + (edge_profiles | map('regex_replace', '^', '--profile=') | list) }}
    stdin: '{{ edge_extension_set | to_json }}'
  delegate_to: localhost
  become: false
  register: edge_resolved
  changed_when: false
  check_mode: false
  tags: [platform-edge-plan]

- name: Use the validated route plan
  ansible.builtin.set_fact:
    edge_plan: '{{ edge_resolved.stdout | from_json }}'
  tags: [platform-edge-plan]

- name: Require the installed mesh before switching an Istio edge
  ansible.builtin.command:
    argv: [kubectl, '--kubeconfig', '{{ edge_kubeconfig }}', -n, istio-system,
           rollout, status, deployment/istio-ingressgateway, '--timeout=60s']
  delegate_to: localhost
  become: false
  changed_when: false
  when: edge_plan.routing.mode == 'istio'

- name: Install host edge dependencies
  ansible.builtin.apt:
    name: [nginx, openssl, python3]
    state: present
    # Cloud images can have recently emptied lists; always refresh before installing.
    update_cache: true
  when: ansible_facts.os_family == 'Debian'

- name: Install Fedora host edge dependencies
  ansible.builtin.dnf:
    name: [nginx, openssl, python3, policycoreutils-python-utils]
    state: present
  when: ansible_facts.distribution == 'Fedora'

- name: Prepare host edge directories
  ansible.builtin.file:
    path: '{{ item }}'
    state: directory
    owner: root
    group: root
    mode: '0755'
  loop:
    - /opt/pharos-local-aai
    - '{{ edge_tls }}'
    - /opt/pharos-edge
    - '{{ edge_extensions }}'

- name: Preserve the pre-migration nginx configuration and TLS once
  ansible.builtin.shell: |
    set -eu
    umask 077
    backup=/opt/pharos-edge/rollback
    if [ -e "$backup" ]; then
      test -f "$backup/.complete"
      exit 0
    fi
    temporary=$(mktemp -d /opt/pharos-edge/.rollback-XXXXXX)
    trap 'rm -rf "$temporary"' EXIT
    for path in /etc/nginx/conf.d/pharos-local-aai.conf /etc/nginx/pharos-local-aai.d '{{ edge_tls }}'; do
      if [ -e "$path" ]; then cp -a "$path" "$temporary/"; fi
    done
    touch "$temporary/.complete"
    mv "$temporary" "$backup"
  args:
    creates: /opt/pharos-edge/rollback/.complete
  no_log: true

- name: Maintain the existing CA and reconcile the catalogue certificate SANs
  ansible.builtin.script:
    cmd: >-
      {{ (edge_controller + '/certificates.py') | quote }}
      --directory {{ edge_tls | quote }}
      --pending {{ edge_reload_pending | quote }}
      {% for name in edge_plan.certificate_names %} --name {{ name | quote }} {% endfor %}
    executable: /usr/bin/python3
  register: edge_certificate
  changed_when: edge_certificate.stdout | trim == 'changed'

- name: Restrict the existing host certificate keys
  ansible.builtin.file:
    path: '{{ edge_tls }}/{{ item }}'
    owner: root
    group: root
    mode: '0600'
  loop: [ca.key, server.key]

- name: Configure the Fedora edge SELinux and pod access permissions
  ansible.builtin.include_tasks: fedora.yml
  when: ansible_facts.distribution == 'Fedora'

- name: Install the catalogue routes with rollback on validation failure
  ansible.builtin.include_tasks: routes.yml
  when: edge_plan.routing.mode == 'istio'

- name: Install the catalogue edge configuration
  ansible.builtin.include_tasks: configuration.yml

- name: Register the caller's routes once the edge serves them
  ansible.builtin.copy:
    content: "{{ lookup('ansible.builtin.file', edge_extension) }}\n"
    dest: "{{ edge_extensions }}/{{ (lookup('ansible.builtin.file', edge_extension) | from_yaml).name }}.yaml"
    owner: root
    group: root
    mode: '0644'
  when: edge_extension | length > 0

- name: Resolve the public names to the edge inside the cluster
  ansible.builtin.include_tasks: dns.yml
  when: edge_plan.routing.mode == 'istio'