---
# nocheck: run-once

# The Matomo API token may be empty on first deployment or when the Matomo container is
# already reachable but the bootstrap has not run yet (so sys-token-store never wrote the
# token file). In that case inj_enabled.matomo is set to false so the NGINX template skips
# the Matomo body snippet (avoiding 'matomo_site_id is undefined') and inject.yml is not run.
# See docs/contributing/design/exceptions.md — "Matomo Token Not Yet Available".

- name: "🔧 Resolve effective Matomo API token for '{{ domain }}'"
  ansible.builtin.set_fact:
    matomo_effective_token: >-
      {{
        (matomo_token_override | default('') | string | trim)
        if (matomo_token_override | default('') | string | trim) != ''
        else (lookup('users', 'administrator').tokens['web-app-matomo'] | default('') | string | trim)
      }}
  no_log: "{{ MASK_CREDENTIALS_IN_LOGS | bool }}"

- name: "🔴 Disable Matomo in inj_enabled for '{{ domain }}' — token not yet available"
  ansible.builtin.set_fact:
    inj_enabled: "{{ inj_enabled | combine({'matomo': false}) }}"
  when: matomo_effective_token == ""

- name: "💉 Inject Matomo tracking for '{{ domain }}'"
  include_tasks: inject.yml
  when: inj_enabled.matomo | bool