---
- block:
    - name: "📁 Create database: {{ database_name }} (host via mysql_db)"
      ansible.mysql.mysql_db:
        name: "{{ database_name }}"
        state: present
        login_user: root
        login_password: "{{ MARIADB_ROOT_PWD }}"
        login_host: "{{ MARIADB_HOST }}"
        login_port: "{{ MARIADB_PORT }}"
        encoding: "{{ MARIADB_ENCODING }}"
        collation: "{{ MARIADB_COLLATION }}"
        config_file: ""

    - name: "📁 Create database user: {{ database_username }} (host via mysql_user)"
      ansible.mysql.mysql_user:
        name: "{{ database_username }}"
        password: "{{ database_password }}"
        host: "%"
        priv: "`{{ database_name }}`.*:ALL"
        state: present
        login_user: root
        login_password: "{{ MARIADB_ROOT_PWD }}"
        login_host: "{{ MARIADB_HOST }}"
        login_port: "{{ MARIADB_PORT }}"
        config_file: ""
  when: MARIADB_EXPOSE_LOCAL | bool

- block:
    - name: "📁 Create database: {{ database_name }} (container via mariadb CLI)"
      ansible.builtin.shell:
        cmd: >-
          container exec -i
          {{ MARIADB_CONTAINER_ADDRESS }}
          sh -c 'mariadb -uroot -p"$MARIADB_ROOT_PASSWORD"'
        stdin: |
          SET @db_name   := '{{ database_name }}';
          SET @charset   := '{{ MARIADB_ENCODING }}';
          SET @collation := '{{ MARIADB_COLLATION }}';
          {{ lookup('file', role_path ~ '/files/sql/create/database.sql') }}
      register: mariadb_create_db
      retries: 30
      delay: 3
      until: mariadb_create_db.rc == 0
      delegate_to: "{{ STACK_HOST }}"
      no_log: "{{ MASK_CREDENTIALS_IN_LOGS | bool }}"
      changed_when: false

    - name: "📁 Create database user + grant privileges (container via mariadb CLI)"
      ansible.builtin.shell:
        cmd: >-
          container exec -i
          {{ MARIADB_CONTAINER_ADDRESS }}
          sh -c 'mariadb -uroot -p"$MARIADB_ROOT_PASSWORD"'
        stdin: |
          SET @db_user := '{{ database_username }}';
          SET @db_pwd  := '{{ database_password | replace("'", "''") }}';
          SET @db_name := '{{ database_name }}';
          {{ lookup('file', role_path ~ '/files/sql/create/user_grant.sql') }}
      register: mariadb_create_user
      retries: 30
      delay: 3
      until: mariadb_create_user.rc == 0
      delegate_to: "{{ STACK_HOST }}"
      no_log: "{{ MASK_CREDENTIALS_IN_LOGS | bool }}"
      changed_when: false
  when: not (MARIADB_EXPOSE_LOCAL | bool)