---
- name: "Debug: allowed_applications"
  debug:
    msg: "{{ allowed_applications }}"
  when: MODE_DEBUG | bool

- name: Merge variables
  block:
  - name: Merge users
    set_fact:
      users: "{{ default_users | combine(users| default({}), recursive=True) }}"
    no_log: "{{ MASK_CREDENTIALS_IN_LOGS | bool }}"

  - name: Merge system_email definitions
    set_fact:
      SYSTEM_EMAIL: "{{ DEFAULT_SYSTEM_EMAIL | combine(system_email | default({}, true), recursive=True) }}"
    no_log: "{{ MASK_CREDENTIALS_IN_LOGS | bool }}"

  - name: Merge application definitions
    set_fact:
      applications: "{{ defaults_applications | merge_with_defaults(applications | default({}, true)) }}"
    no_log: "{{ MASK_CREDENTIALS_IN_LOGS | bool }}"

  - name: "Sanity check: all group_names must exist in applications"
    assert:
      that:
        - item in applications
      fail_msg: "Group '{{ item }}' has no entry in 'applications'"
      success_msg: "Group '{{ item }}' is defined in 'applications'"
    loop: "{{ group_names }}"

  - name: Merge current play applications
    set_fact:
      current_play_applications: >-
        {{ 
          applications |
          applications_if_group_and_deps(group_names)
        }}
    no_log: "{{ MASK_CREDENTIALS_IN_LOGS | bool }}"

  - name: Merge current play domain definitions
    set_fact:
      current_play_domains: >- 
        {{  current_play_applications |
            canonical_domains_map(PRIMARY_DOMAIN) | 
            combine(domains | default({}, true), recursive=True) 
        }}
  
  - name: Merge domain definitions for all domains
    set_fact:
      domains: >-
        {{ 
          defaults_applications | 
          canonical_domains_map(PRIMARY_DOMAIN) | 
          combine(current_play_domains, recursive=True) 
        }}
  - name: Merge redirect_domain_mappings
    set_fact:
      # The following mapping is necessary to define the exceptions for domains which are created, but which aren't used
      redirect_domain_mappings: "{{
        []  | 
        add_redirect_if_group('web-svc-asset', domains | get_domain('web-svc-asset'), domains | get_domain('web-svc-file'),  group_names) | 
        merge_mapping(redirect_domain_mappings| default([]), 'source')
        }}"

  - name: Set current play redirect domain mappings 
    set_fact:
      redirect_domain_mappings: >-
        {{ 
          current_play_applications |
          domain_mappings(PRIMARY_DOMAIN) | 
          merge_mapping(redirect_domain_mappings, 'source') 
        }}

  - name: Set current play all domains incl. www redirect if enabled
    set_fact:
      current_play_domains_all: >-
        {{
          (current_play_domains |
          combine(
            redirect_domain_mappings | default([]) | 
            items2dict(key_name='source', value_name='source'),
            recursive=True
          )) |
          generate_all_domains(
            ('web-opt-rdr-www' in group_names)
          )
        }}

  - name: Merge networks definitions
    set_fact:
      networks: "{{ defaults_networks | combine(networks | default({}, true), recursive=True) }}"
  
  - name: Merge OIDC configuration
    set_fact:
      OIDC: "{{ defaults_oidc | combine(OIDC | default({}, true), recursive=True) }}"
    no_log: "{{ MASK_CREDENTIALS_IN_LOGS | bool }}"

  - name: Merge design configuration
    set_fact:
      design: "{{ defaults_design | combine(design | default({}, true), recursive=True) }}"

  - name: Merge service_provider configuration
    set_fact:
      service_provider: "{{ defaults_service_provider | combine(service_provider | default({}, true), recursive=True) }}"

- name: init root user
  include_role:
    name: user-root

# @todo change this to role based todo
- name: update device
  include_role:
    name: update-compose
  when: MODE_UPDATE | bool

- name: "Load base roles"
  include_tasks: "./tasks/groups/{{ item }}-roles.yml"
  loop:
    - drv         # 1. Load driver roles
    - gen         # 2. Load generic roles
    - svc-net     # 3. Load network roles
    - svc-db      # 4. Load database roles
    - svc-prx     # 5. Load proxy roles
  loop_control:
    label: "{{ item }}-roles.yml"