- name: Подготовка директории
  become: true
  ansible.builtin.file:
    state: directory
    path: /opt/nginx
    mode: "0755"

- name: Проверка наличия сертификата
  ansible.builtin.stat:
    path: /opt/nginx/ssl/cert.pem
  register: cert_file

- name: Проверка наличия приватного ключа
  ansible.builtin.stat:
    path: /opt/nginx/ssl/key.pem
  register: key_file

- name: Создание директории для сертификатов
  become: true
  ansible.builtin.file:
    path: /opt/nginx/ssl
    state: directory
    owner: root
    group: root
    mode: '0755'
  when: not cert_file.stat.exists or not key_file.stat.exists

- name: Генерация приватного ключа
  become: true
  community.crypto.openssl_privatekey:
    path: /opt/nginx/ssl/key.pem
    size: 2048
    owner: root
    group: 101
    mode: '0640'
  when: not cert_file.stat.exists or not key_file.stat.exists

- name: Генерация CSR
  become: true
  community.crypto.openssl_csr:
    path: /opt/nginx/ssl/nginx.csr
    privatekey_path: /opt/nginx/ssl/key.pem
    common_name: nginx.local
    subject_alt_name:
      - "DNS:nginx.local"
      - "DNS:localhost"
      - "IP:{{ansible_facts['default_ipv4']['address']}}"
  when: not cert_file.stat.exists or not key_file.stat.exists

- name: Генерация самоподписанного сертификата
  become: true
  community.crypto.x509_certificate:
    path: /opt/nginx/ssl/cert.pem
    privatekey_path: /opt/nginx/ssl/key.pem
    csr_path: /opt/nginx/ssl/nginx.csr
    provider: selfsigned
    selfsigned_not_after: "+3650d"
  when: not cert_file.stat.exists or not key_file.stat.exists

- name: Изменение прав на сертификат
  become: true
  ansible.builtin.file:
    path: /opt/nginx/ssl/cert.pem
    owner: root
    group: "101"
    mode: "0644"

- name: Копирование файлов конфигурации
  become: true
  ansible.builtin.copy:
    src: "{{item}}"
    dest: "/opt/nginx/{{item}}"
    mode: "0755"
  loop:
    - nginx.conf
    - Dockerfile
    - index.html
    - docker-compose.yaml
    - backup.sh

- name: Подготовка директории бекапов
  become: true
  ansible.builtin.file:
    state: directory
    path: /opt/nginx/backups
    mode: "0755"

- name: Настройка еженедельного резервного копирования Nginx
  become: true
  ansible.builtin.cron:
    name: "nginx configuration backup"
    minute: "0"
    hour: "1"
    weekday: "1"
    job: "/opt/nginx/backup.sh"
    env: false

- name: Сборка и запуск Docker Compose
  community.docker.docker_compose_v2:
    project_src: /opt/nginx
    state: present
    build: always
  become: true