---
# Jar Lid Archive on its own box, published from the edge host.
#
# See roles/jar_lid_archive/README.md. Per-host values (domain, port, seed users,
# secrets) are in host_vars/<host>/, so a production host is a new inventory
# entry in [jar_lid_archive], not a new playbook.
- name: Deploy Jar Lid Archive
  hosts: jar_lid_archive
  become: yes
  roles:
    - jar_lid_archive
    # "Does the app answer", as opposed to "are the containers up". /health/
    # runs SELECT 1 and touches the bucket, and returns 503 if either fails.
    - role: healthcheck
      vars:
        healthcheck_name: jar-lid-archive
        healthcheck_description: "Jar Lid Archive /health/ (app, database and photo store)"
        healthcheck_command: "curl -fsS --max-time 10 -o /dev/null http://127.0.0.1:{{ jar_lid_archive_port }}/health/"
        healthcheck_push_url: "https://{{ subdomains.gatus }}.{{ root_domain }}/api/v1/endpoints/probe_{{ jar_lid_archive_instance }}/external"
        healthcheck_push_token: "{{ gatus_push_tokens[inventory_hostname] }}"

- name: Publish Jar Lid Archive from the edge host
  hosts: edge
  become: yes
  tasks:
    # No basic auth: the one-off links (/links/...) are opened by people who have
    # no account and no proxy credential. The app's own login guards the rest.
    #
    # Caddy sets X-Forwarded-Proto: https and overwrites any value the client
    # sent, which is what lets the app trust it (DJANGO_BEHIND_TLS_PROXY).
    #
    # No request size limit is set, deliberately: Caddy has none by default, and
    # phones upload multi-megabyte photos.
    - name: Expose Jar Lid Archive over HTTPS
      ansible.builtin.include_role:
        name: caddy_site
      vars:
        caddy_site_name: "{{ hostvars[jla_host].jar_lid_archive_instance }}"
        caddy_site_domain: "{{ hostvars[jla_host].jar_lid_archive_domain }}"
        # Tailscale MagicDNS: the box has no public address.
        caddy_site_upstream: "{{ hostvars[jla_host].ansible_host }}:{{ hostvars[jla_host].jar_lid_archive_port }}"
        caddy_site_resolvers: "100.100.100.100"
      loop: "{{ groups['jar_lid_archive'] }}"
      # Not `item`: the role's own tasks loop, and would shadow it.
      loop_control:
        loop_var: jla_host

    # The per-site validate cannot catch a conflict between sites.
    - name: Validate the whole Caddyfile
      ansible.builtin.command: caddy validate --config /etc/caddy/Caddyfile --adapter caddyfile
      changed_when: false