---
# Config, unit, start, prove it is up.

# The key encrypts every stored password. Starting without it would come up
# fine and quietly use a built-in default, so this fails the run instead.
- name: Assert the password encryption key arrived from the vault
  ansible.builtin.assert:
    that:
      - navidrome_password_encryption_key | length > 0
    fail_msg: >-
      navidrome_password_encryption_key is empty. It is injected by
      services/navidrome/deploy_navidrome_playbook.yml from
      group_vars/all/vault.yml. Navidrome stores user passwords REVERSIBLY
      (the Subsonic API needs the plaintext to compute md5(password+salt)),
      and this key is what encrypts them at rest. Set it before the first
      account exists - changing it later invalidates every stored password.
    quiet: yes

- name: Write the navidrome configuration
  ansible.builtin.template:
    src: navidrome.toml.j2
    dest: "{{ navidrome_config_file }}"
    owner: root
    group: "{{ navidrome_group }}"
    mode: '0640'
  diff: "{{ navidrome_reveal_config | default(false) | bool }}"
  notify: Restart navidrome

- name: Create the navidrome systemd unit
  ansible.builtin.template:
    src: navidrome.service.j2
    dest: /etc/systemd/system/navidrome.service
    owner: root
    group: root
    mode: '0644'
  notify: Restart navidrome

- name: Reload systemd daemon
  systemd:
    daemon_reload: yes

- name: Enable and start navidrome
  systemd:
    name: navidrome
    enabled: yes
    state: started

- name: Flush handlers so navidrome is running before we probe it
  meta: flush_handlers

- name: Wait for the navidrome HTTP port
  ansible.builtin.wait_for:
    port: "{{ navidrome_port }}"
    host: 127.0.0.1
    delay: 5
    timeout: 300
  ignore_errors: yes

- name: Check the navidrome service status
  systemd:
    name: navidrome
  register: navidrome_status
  changed_when: false

- name: Display the navidrome service status
  ansible.builtin.debug:
    msg: "navidrome is {{ 'running' if navidrome_status.status.ActiveState == 'active' else 'NOT running' }}"