---
# Directory layout follows upstream's systemd guide:
# https://docs.getmonero.org/running-node/monerod-systemd/
# The data directory is not here - it is the mount point, handled in storage.yml.

- name: Create the Monero config directory
  ansible.builtin.file:
    path: "{{ monero_conf_dir }}"
    state: directory
    owner: root
    group: "{{ monero_group }}"
    mode: '0750'

- name: Create the Monero log directory
  ansible.builtin.file:
    path: "{{ monero_log_dir }}"
    state: directory
    owner: "{{ monero_user }}"
    group: "{{ monero_group }}"
    mode: '0750'

- name: Assert the RPC credentials are set
  ansible.builtin.assert:
    that:
      - monero_rpc_user | length > 0
      - monero_rpc_password | length > 0
    quiet: true
    fail_msg: >-
      monero_rpc_user and monero_rpc_password must be set. They are the only
      authentication in front of the restricted RPC that Caddy publishes to the
      internet, and monerod started without them would serve it to anyone.

- name: Create monerod.conf
  ansible.builtin.template:
    src: monerod.conf.j2
    dest: "{{ monero_conf_dir }}/monerod.conf"
    owner: root
    group: "{{ monero_group }}"
    mode: '0640'
  # monerod.conf carries the RPC login, which is the only authentication in
  # front of the endpoint Caddy publishes. `--diff` prints rendered content, so
  # running with --diff would put it on the terminal and into any log capturing
  # it. Suppressed by default; pass -e monero_reveal_config=true when you
  # genuinely need the diff. This is a task keyword, not a module parameter.
  diff: "{{ monero_reveal_config | default(false) | bool }}"
  notify: Restart monerod

- name: Create the monerod systemd unit
  ansible.builtin.template:
    src: monerod.service.j2
    dest: /etc/systemd/system/monerod.service
    owner: root
    group: root
    mode: '0644'
  notify: Restart monerod