- name: Install and configure Caddy on Debian 12
  hosts: caddy
  become: yes

  tasks:
    - name: Install required packages
      apt:
        name:
          - debian-keyring
          - debian-archive-keyring
          - apt-transport-https
          - curl
        state: present
        update_cache: yes

    # Caddy's signing subkey carries an expiry date, and Cloudsmith republishes
    # the key with a refreshed binding signature before it lapses. Re-fetch on
    # every run: pinning the keyring with `creates:` leaves the host stuck on a
    # key that eventually expires and breaks `apt update` with an sqv error.
    - name: Ensure apt keyrings directory exists
      ansible.builtin.file:
        path: /etc/apt/keyrings
        state: directory
        owner: root
        group: root
        mode: '0755'

    - name: Download Caddy GPG armored key
      ansible.builtin.get_url:
        url: https://dl.cloudsmith.io/public/caddy/stable/gpg.key
        dest: /etc/apt/keyrings/caddy-stable-archive-keyring.asc
        mode: '0644'
      register: caddy_key_download

    - name: Check for existing Caddy keyring
      ansible.builtin.stat:
        path: /usr/share/keyrings/caddy-stable-archive-keyring.gpg
      register: caddy_keyring

    - name: Convert ASCII armored key to binary keyring
      ansible.builtin.command:
        cmd: gpg --batch --yes --dearmor -o /usr/share/keyrings/caddy-stable-archive-keyring.gpg /etc/apt/keyrings/caddy-stable-archive-keyring.asc
      when: caddy_key_download.changed or not caddy_keyring.stat.exists

    - name: Ensure permissions on keyring file
      ansible.builtin.file:
        path: /usr/share/keyrings/caddy-stable-archive-keyring.gpg
        owner: root
        group: root
        mode: '0644'

    - name: Add Caddy repository list file
      ansible.builtin.get_url:
        url: https://dl.cloudsmith.io/public/caddy/stable/debian.deb.txt
        dest: /etc/apt/sources.list.d/caddy-stable.list
        mode: '0644'
        validate_certs: yes

    - name: Update apt cache after adding repo
      apt:
        update_cache: yes

    - name: Install Caddy
      apt:
        name: caddy
        state: present

    - name: Ensure Caddy service is enabled and started
      systemd:
        name: caddy
        enabled: yes
        state: started

    - name: Allow HTTP through UFW
      ufw:
        rule: allow
        port: '80'
        proto: tcp

    - name: Allow HTTPS through UFW
      ufw:
        rule: allow
        port: '443'
        proto: tcp