personal_infra/ansible/roles/signal_api/tasks/main.yml

---
- name: Assert Docker is available
  ansible.builtin.command: docker --version
  register: signal_docker_check
  changed_when: false

# Created explicitly rather than by either compose file, so neither stack has to
# be deployed before the other and neither owns it.
- name: Ensure the shared monitoring network exists
  ansible.builtin.command: "docker network create {{ signal_api_network }}"
  register: signal_net
  changed_when: "'already exists' not in signal_net.stderr"
  failed_when:
    - signal_net.rc != 0
    - "'already exists' not in signal_net.stderr"

- name: Create the signal-api directory
  ansible.builtin.file:
    path: "{{ signal_api_dir }}"
    state: directory
    owner: root
    group: root
    mode: "0755"

# Owned by the container's uid, NOT root.
#
# The image drops to uid 1000 (`setpriv --reuid=1000`), and a root-owned 0700
# directory cannot be traversed by uid 1000 - signal-cli then fails to write the
# account and linking silently never completes, leaving a 39-byte accounts.json
# with no accounts and the API returning "Failed to read local accounts list".
#
# 0700 on uid 1000 is still private: only that uid and root can read the Signal
# private keys, which is the property actually wanted.
- name: Create the signal-api data directory owned by the container user
  ansible.builtin.file:
    path: "{{ signal_api_data_dir }}"
    state: directory
    owner: "{{ signal_api_uid }}"
    group: "{{ signal_api_uid }}"
    mode: "0700"

- name: Write the IPv4-preference resolver config
  ansible.builtin.template:
    src: gai.conf.j2
    dest: "{{ signal_api_dir }}/gai.conf"
    owner: root
    group: root
    mode: "0644"

- name: Write the docker compose file
  ansible.builtin.template:
    src: docker-compose.yml.j2
    dest: "{{ signal_api_dir }}/docker-compose.yml"
    owner: root
    group: root
    mode: "0644"

- name: Pull the pinned signal-api image
  ansible.builtin.command:
    cmd: docker compose pull
    chdir: "{{ signal_api_dir }}"
  register: signal_pull
  changed_when: "'Downloaded newer image' in signal_pull.stderr or 'Pull complete' in signal_pull.stderr"

- name: Start signal-api
  ansible.builtin.command:
    cmd: docker compose up -d --remove-orphans
    chdir: "{{ signal_api_dir }}"
  register: signal_up
  changed_when: "'Started' in signal_up.stderr or 'Created' in signal_up.stderr or 'Recreated' in signal_up.stderr"

- name: Wait for the API to answer
  ansible.builtin.command:
    cmd: "docker exec {{ signal_api_service_name }} curl -fsS http://localhost:{{ signal_api_port }}/v1/health"
  register: signal_health
  until: signal_health.rc == 0
  retries: 12
  delay: 5
  changed_when: false

- name: Report whether an account is linked yet
  ansible.builtin.command:
    cmd: "docker exec {{ signal_api_service_name }} curl -fsS http://localhost:{{ signal_api_port }}/v1/accounts"
  register: signal_accounts
  changed_when: false
  failed_when: false

- name: Show the linking status
  ansible.builtin.debug:
    msg: >-
      {{ 'Linked account(s): ' ~ signal_accounts.stdout
         if (signal_accounts.stdout | default('[]') | trim) not in ['[]', '', 'null']
         else 'NO ACCOUNT LINKED YET - this is a one-time manual step, see the role README.' }}