---
- name: Validate required variables are set
  ansible.builtin.assert:
    that:
      - unifi_bind_address is defined
      - unifi_bind_address | length > 0
    fail_msg: |
      unifi_bind_address is required (IP of the interface to bind to).
      See roles/unifi/defaults/main.yml for configuration instructions.
    success_msg: "Variable validation passed"

- name: Create unifi project directory
  ansible.builtin.file:
    path: "{{ podman_projects_dir | default('/opt/podman') }}/unifi"
    state: directory
    owner: "{{ ansible_user }}"
    group: "{{ ansible_user }}"
    mode: "0755"

- name: Create unifi data directory
  ansible.builtin.file:
    path: "{{ unifi_data_dir }}"
    state: directory
    owner: "{{ ansible_user }}"
    group: "{{ ansible_user }}"
    mode: "0755"

- name: Get current unifi image ID
  ansible.builtin.command: "podman image inspect --format {% raw %}{{.Id}}{% endraw %} {{ unifi_image }}:{{ unifi_version }}"
  register: unifi_image_id_before
  failed_when: false # image may not exist yet on first deploy
  changed_when: false
  become: false
  become_user: "{{ ansible_user }}"

- name: Pull UniFi container image
  ansible.builtin.command: "podman pull --quiet {{ unifi_image }}:{{ unifi_version }}"
  register: pull_result
  changed_when: pull_result.stdout != unifi_image_id_before.stdout
  become: false
  become_user: "{{ ansible_user }}"
  notify: Restart unifi

- name: Deploy Kubernetes YAML for unifi
  ansible.builtin.template:
    src: unifi.yaml.j2
    dest: "{{ podman_projects_dir | default('/opt/podman') }}/unifi/unifi.yaml"
    owner: "{{ ansible_user }}"
    group: "{{ ansible_user }}"
    mode: "0644"
  notify: Restart unifi

- name: Get home directory for {{ ansible_user }}
  ansible.builtin.getent:
    database: passwd
    key: "{{ ansible_user }}"

- name: Set user home directory fact
  ansible.builtin.set_fact:
    user_home_dir: "{{ ansible_facts['getent_passwd'][ansible_user][4] }}"

- name: Create systemd user directory for unifi
  ansible.builtin.file:
    path: "{{ user_home_dir }}/.config/systemd/user"
    state: directory
    owner: "{{ ansible_user }}"
    group: "{{ ansible_user }}"
    mode: "0755"

- name: Create systemd service for unifi (user scope)
  ansible.builtin.template:
    src: unifi.service.j2
    dest: "{{ user_home_dir }}/.config/systemd/user/unifi.service"
    owner: "{{ ansible_user }}"
    group: "{{ ansible_user }}"
    mode: "0644"
  notify: Reload systemd user

- name: Enable lingering for user {{ ansible_user }}
  ansible.builtin.command: "loginctl enable-linger {{ ansible_user }}"
  when: ansible_user != 'root'

- name: Setup firewall rules for UniFi (TCP)
  community.general.ufw:
    rule: allow
    src: "{{ item.0 }}"
    port: "{{ item.1.port }}"
    proto: tcp
    direction: in
    comment: "UniFi {{ item.1.name }}"
  loop: "{{ unifi_firewall_allowed_sources | product(unifi_tcp_ports) }}"
  vars:
    unifi_tcp_ports:
      - { port: "8080", name: "device inform" }
      - { port: "8443", name: "web interface" }
  retries: 5
  delay: 2
  register: ufw_result
  until: ufw_result is succeeded

- name: Setup firewall rules for UniFi (UDP)
  community.general.ufw:
    rule: allow
    src: "{{ item.0 }}"
    port: "{{ item.1.port }}"
    proto: udp
    direction: in
    comment: "UniFi {{ item.1.name }}"
  loop: "{{ unifi_firewall_allowed_sources | product(unifi_udp_ports) }}"
  vars:
    unifi_udp_ports:
      - { port: "3478", name: "STUN" }
      - { port: "10001", name: "device discovery" }
  retries: 5
  delay: 2
  register: ufw_result
  until: ufw_result is succeeded

- name: Enable and start unifi service (user scope)
  ansible.builtin.systemd:
    name: unifi.service
    enabled: true
    state: started
    scope: user
  become: false
  become_user: "{{ ansible_user }}"