---
- name: Assert caddy_site parameters are sane
  ansible.builtin.assert:
    that:
      - caddy_site_name | length > 0
      - caddy_site_domain | length > 0
      - (caddy_site_upstream | length > 0) or (caddy_site_root | length > 0) or (caddy_site_body | length > 0)
      - caddy_site_basic_auth is not mapping
    fail_msg: >-
      caddy_site: '{{ caddy_site_name | default("<unnamed>") }}' needs a name, a domain and
      one of caddy_site_upstream / caddy_site_root / caddy_site_body.
      caddy_site_basic_auth must be a LIST of {user, hash} — Ansible does not template dict keys.
    quiet: true

- name: Ensure Caddy sites-enabled directory exists
  ansible.builtin.file:
    path: "{{ caddy_sites_dir }}"
    state: directory
    owner: root
    group: root
    mode: '0755'

- name: Ensure Caddyfile imports sites-enabled
  ansible.builtin.lineinfile:
    path: /etc/caddy/Caddyfile
    line: 'import sites-enabled/*'
    insertafter: EOF
    state: present
    create: yes
    mode: '0644'
    backup: yes

# `validate` runs `caddy validate` against the rendered temp file before it is
# moved into place: verified on vipy that a single site fragment validates
# cleanly (rc=0, "Valid configuration") and that a malformed one is rejected
# (rc=1). A failed validate leaves the live file untouched.
- name: "Write Caddy site '{{ caddy_site_name }}'"
  ansible.builtin.template:
    src: site.conf.j2
    dest: "{{ caddy_sites_dir }}/{{ caddy_site_name }}.conf"
    owner: root
    group: root
    mode: '0644'
    validate: "caddy validate --adapter caddyfile --config %s"
  diff: "{{ caddy_site_reveal | bool }}"
  notify: Reload caddy