---
- name: Créer le répertoire de la stack BunkerWeb
  ansible.builtin.file:
    path: "{{ bw_dir }}"
    state: directory
    owner: root
    group: root
    mode: "0750"

- name: Créer le réseau partagé bw-services
  ansible.builtin.shell: docker network inspect bw-services >/dev/null 2>&1 || { docker network create bw-services && echo created; }
  register: bw_net
  changed_when: "'created' in bw_net.stdout"

- name: Générer le compose BunkerWeb
  ansible.builtin.template:
    src: compose.yml.j2
    dest: "{{ bw_dir }}/compose.yml"
    owner: root
    group: root
    mode: "0600"   # contient les secrets
    validate: docker compose -f %s config -q

- name: Démarrer la stack BunkerWeb
  community.docker.docker_compose_v2:
    project_src: "{{ bw_dir }}"
    project_name: bunkerweb
    pull: missing
    remove_orphans: true
    state: present
  register: bw_compose

- name: Attendre que BunkerWeb réponde sur 443
  ansible.builtin.wait_for:
    host: "{{ ansible_host }}"
    port: 443
    timeout: 300

- name: Attendre que le site api réponde au travers du WAF
  ansible.builtin.uri:
    url: "https://{{ ansible_host }}/get"
    headers:
      Host: "api{{ poc_fqdn_suffix }}"
    validate_certs: false
    status_code: 200
  register: bw_probe
  until: bw_probe.status == 200
  retries: 30
  delay: 10

- name: Écrire le récapitulatif des accès côté contrôleur (credentials/ACCES.txt)
  ansible.builtin.copy:
    dest: "{{ playbook_dir }}/../credentials/ACCES.txt"
    mode: "0600"
    content: |
      UI BunkerWeb : https://bwui{{ poc_fqdn_suffix }}/   (WAF {{ ansible_host }})
      Identifiant  : {{ bw_ui_admin_user }}
      Mot de passe : {{ bw_ui_admin_password }}
  delegate_to: localhost
  become: false

- name: Rappel des accès
  ansible.builtin.debug:
    msg: "UI BunkerWeb : https://bwui{{ poc_fqdn_suffix }}/ , identifiants dans credentials/ACCES.txt"