---
- name: Validate required configuration
  ansible.builtin.assert:
    that:
      - sys_autoupdate_ntfy_topic is defined
      - sys_autoupdate_ntfy_topic | length > 0
    fail_msg: |
      sys_autoupdate_ntfy_topic is required.
      See roles/sys_autoupdate/defaults/main.yml for configuration.

- name: Load OS-specific variables
  ansible.builtin.include_vars: "{{ item }}"
  with_first_found:
    - "{{ ansible_facts['os_family'] }}.yml"
    - debian.yml

- name: Install required packages
  ansible.builtin.package:
    name: "{{ sys_autoupdate_packages }}"
    state: present

- name: Reconcile apt package holds (Debian/Ubuntu)
  when: ansible_facts['os_family'] == 'Debian'
  block:
    - name: Get currently held apt packages
      ansible.builtin.command: apt-mark showhold
      register: sys_autoupdate_current_holds
      changed_when: false

    - name: Hold packages listed in sys_autoupdate_ignore_packages
      ansible.builtin.dpkg_selections:
        name: "{{ item }}"
        selection: hold
      loop: "{{ sys_autoupdate_ignore_packages }}"
      when: item not in sys_autoupdate_current_holds.stdout_lines

  # NOTE: holds set manually (outside this role) or in previous runs are not
  # automatically released when removed from sys_autoupdate_ignore_packages.
  # This is intentional: avoids accidentally unholding operator-pinned packages.
  # To release a hold, run: sudo apt-mark unhold <package>

- name: Deploy autoupdate script
  ansible.builtin.template:
    src: sys-autoupdate.sh.j2
    dest: "{{ sys_autoupdate_script_path }}"
    owner: root
    group: root
    mode: "0755"
  notify: Restart sys-autoupdate timer

- name: Deploy systemd service
  ansible.builtin.template:
    src: sys-autoupdate.service.j2
    dest: /etc/systemd/system/sys-autoupdate.service
    owner: root
    group: root
    mode: "0644"
  notify: Restart sys-autoupdate timer

- name: Deploy systemd timer
  ansible.builtin.template:
    src: sys-autoupdate.timer.j2
    dest: /etc/systemd/system/sys-autoupdate.timer
    owner: root
    group: root
    mode: "0644"
  notify: Restart sys-autoupdate timer

- name: Flush handlers before enabling timer
  ansible.builtin.meta: flush_handlers

- name: Enable and start update timer
  ansible.builtin.systemd:
    name: sys-autoupdate.timer
    enabled: true
    state: started