- name: Hetzner
  hosts: beepi
  become: true
  vars:
    user: hetzner
    user_home: /home/hetzner

    hetzner_raid_mount: /home/beeshare/raid

    hetzner_paths:
      - src: /home/beeshare/raid/serverBackup
        dest: ./beepi
      - src: /home/beeshare/raid/foundry/backup
        dest: ./foundry

  tasks:
    - name: Install rsync
      ansible.builtin.apt:
        name: rsync
        state: present

    - name: Create user
      ansible.builtin.user:
        name: "{{ user }}"
        home: "{{ user_home }}"
        shell: /usr/sbin/nologin
        create_home: true

    - name: Create ssh directory
      ansible.builtin.file:
        path: "{{ user_home }}/.ssh"
        state: directory
        owner: "{{ user }}"
        group: "{{ user }}"
        mode: '0700'

    - name: Generate ssh key
      ansible.builtin.command:
        cmd: "ssh-keygen -t ed25519 -N '' -C beepi-hetzner -f {{ user_home }}/.ssh/id_ed25519"
        creates: "{{ user_home }}/.ssh/id_ed25519"

    - name: Set key ownership
      ansible.builtin.file:
        path: "{{ user_home }}/.ssh/{{ item.name }}"
        owner: "{{ user }}"
        group: "{{ user }}"
        mode: "{{ item.mode }}"
      loop:
        - name: id_ed25519
          mode: '0600'
        - name: id_ed25519.pub
          mode: '0644'

    - name: Scan storage box host key
      ansible.builtin.command:
        cmd: "ssh-keyscan -p {{ hetzner_port }} {{ hetzner_host }}"
      register: hetzner_hostkey
      changed_when: false
      when: hetzner_host | length > 0

    - name: Pin known hosts
      ansible.builtin.copy:
        dest: "{{ user_home }}/.ssh/known_hosts"
        content: "{{ hetzner_hostkey.stdout }}\n"
        owner: "{{ user }}"
        group: "{{ user }}"
        mode: '0600'
      when: hetzner_host | length > 0

    - name: Copy sync script
      ansible.builtin.template:
        src: hetznerSync.sh.j2
        dest: /opt/backup/hetznerSync.sh
        mode: '0700'
      when: hetzner_host | length > 0

    - name: Schedule daily sync
      ansible.builtin.cron:
        name: beepi hetzner sync
        user: root
        minute: '0'
        hour: '7'
        job: /opt/backup/hetznerSync.sh >> /var/log/beepi-backup.log 2>&1
      when: hetzner_host | length > 0

    - name: Copy metrics collector
      ansible.builtin.template:
        src: hetznerMetrics.sh.j2
        dest: /opt/backup/hetznerMetrics.sh
        mode: '0700'
      when: hetzner_host | length > 0

    - name: Install metrics timer
      ansible.builtin.copy:
        dest: "/etc/systemd/system/beepi-hetzner-metrics.{{ item.kind }}"
        content: "{{ item.content }}"
        mode: '0644'
      loop:
        - kind: service
          content: |
            [Unit]
            Description=Collect hetzner storage box metrics

            [Service]
            Type=oneshot
            ExecStart=/opt/backup/hetznerMetrics.sh
        - kind: timer
          content: |
            [Unit]
            Description=Collect hetzner storage box metrics

            [Timer]
            OnBootSec=5min
            OnUnitActiveSec=1h
            AccuracySec=5min

            [Install]
            WantedBy=timers.target
      when: hetzner_host | length > 0
      notify: Reload systemd

    - name: Flush handlers
      ansible.builtin.meta: flush_handlers

    - name: Enable metrics timer
      ansible.builtin.systemd_service:
        name: beepi-hetzner-metrics.timer
        state: started
        enabled: true
      when: hetzner_host | length > 0

    - name: Run metrics collector once
      changed_when: true
      ansible.builtin.command:
        cmd: /opt/backup/hetznerMetrics.sh
      when: hetzner_host | length > 0

    - name: Debug
      ansible.builtin.debug:
        msg:
          - "Test manually: sudo /opt/backup/hetznerSync.sh"
          - "Read logs: sudo tail -50 /var/log/beepi-backup.log"
      tags:
        - always

  handlers:
    - name: Reload systemd
      ansible.builtin.systemd_service:
        daemon_reload: true