---
# "Is monerod actually answering", as opposed to infra/401's "is the unit
# active". A daemon can be perfectly `active` and wedged.

- name: Install the health check's dependencies
  apt:
    name:
      - curl
      - jq
    state: present

- name: Create the monerod health check script
  ansible.builtin.template:
    src: healthcheck.sh.j2
    dest: /usr/local/bin/monerod-healthcheck-push.sh
    owner: root
    group: root
    mode: '0755'
    validate: "bash -n %s"

# 0600: this unit carries both the Gatus bearer token and the RPC password.
# They live here rather than in the script so the script itself stays readable
# and credential-free.
- name: Create the monerod health check systemd service
  ansible.builtin.template:
    src: healthcheck.service.j2
    dest: /etc/systemd/system/monerod-healthcheck.service
    owner: root
    group: root
    mode: '0600'
  notify: Restart monerod health check timer

- name: Create the monerod health check systemd timer
  ansible.builtin.template:
    src: healthcheck.timer.j2
    dest: /etc/systemd/system/monerod-healthcheck.timer
    owner: root
    group: root
    mode: '0644'
  notify: Restart monerod health check timer

- name: Reload systemd daemon after health check units
  systemd:
    daemon_reload: yes

# Ungated: enabling a timer is deployment, not monitoring.
- name: Enable and restart the monerod health check timer
  systemd:
    name: monerod-healthcheck.timer
    enabled: yes
    state: restarted
    daemon_reload: yes

# Arms the timer and smoke-tests the check. Restarting the timer alone is not
# enough with OnBootSec + OnUnitActiveSec - see roles/bitcoin_knots/README.md.
- name: Run the monerod health check once to arm the timer
  ansible.builtin.command: systemctl start monerod-healthcheck.service
  changed_when: false