---
- name: Créer l'arborescence des applis
  ansible.builtin.file:
    path: "{{ item }}"
    state: directory
    mode: "0755"
  loop:
    - "{{ apps_dir }}"
    - "{{ apps_dir }}/www"

- name: Déposer la vitrine statique
  ansible.builtin.template:
    src: "www/{{ item }}.j2"
    dest: "{{ apps_dir }}/www/{{ item }}"
    mode: "0644"
  loop:
    - index.html
    - contact.html

- name: Créer le réseau partagé bw-services (mode single)
  ansible.builtin.shell: docker network inspect bw-services >/dev/null 2>&1 || { docker network create bw-services && echo created; }
  register: apps_net
  changed_when: "'created' in apps_net.stdout"
  when: poc_mode == 'single'

- name: Générer le compose des applis
  ansible.builtin.template:
    src: compose.yml.j2
    dest: "{{ apps_dir }}/compose.yml"
    mode: "0644"
    validate: docker compose -f %s config -q

- name: Démarrer les applis
  community.docker.docker_compose_v2:
    project_src: "{{ apps_dir }}"
    project_name: apps
    pull: missing
    remove_orphans: true
    state: present

- name: Filtrage des ports publiés (mode split)
  when: poc_mode == 'split'
  block:
    - name: Installer iptables
      ansible.builtin.apt:
        name: iptables
        state: present

    - name: Déposer le script de filtrage
      ansible.builtin.template:
        src: bwpoc-firewall.sh.j2
        dest: /usr/local/sbin/bwpoc-firewall.sh
        mode: "0755"
      notify: Recharger le filtrage applis

    - name: Déposer l'unité systemd
      ansible.builtin.copy:
        src: bwpoc-firewall.service
        dest: /etc/systemd/system/bwpoc-firewall.service
        mode: "0644"
      notify: Recharger le filtrage applis

    - name: Activer le filtrage au démarrage
      ansible.builtin.systemd_service:
        name: bwpoc-firewall.service
        enabled: true
        state: started
        daemon_reload: true