---
# run_once_sys_stk_backend: disabled

- name: "🔍 Resolve backend context for '{{ application_id }}'"
  ansible.builtin.set_fact:
    _sys_stk_backend_database_consumer_id: >-
      {{ database_consumer_id | default(application_id) }}
    _sys_stk_backend_database_enabled: >-
      {{ lookup('database', application_id, 'enabled') | bool }}
  changed_when: false

- name: "🐛 DEBUG | SYS-STK-BACKEND | Application context"
  ansible.builtin.debug:
    msg:
      - "application_id={{ application_id }}"
      - "database_consumer_id={{ _sys_stk_backend_database_consumer_id }}"
      - "database_enabled={{ _sys_stk_backend_database_enabled }}"
      - "sso_proxy_enabled={{ lookup('sso', application_id, 'is_proxy_gated') }}"
  when: MODE_DEBUG | bool

- name: "🧩 For '{{ application_id }}': Load central RDBMS"
  include_role:
    name: sys-svc-rdbms
    public: false
  vars:
    database_consumer_id: "{{ _sys_stk_backend_database_consumer_id }}"
  when: _sys_stk_backend_database_enabled | bool

- name: "🧩 '{{ application_id }}': load per-consumer central object store"
  include_role:
    name: sys-svc-objstore
    public: false
  vars:
    objstore_consumer_id: "{{ application_id }}"
  when:
    - lookup('objstore', application_id, 'enabled') | bool
    - lookup('objstore', application_id, 'shared') | bool
    - application_id != lookup('objstore', application_id, 'id')

- name: "🧩 For '{{ application_id }}': Load central engines (per-consumer provisioning)"
  include_role:
    name: sys-svc-engine
    public: false
  vars:
    engine_consumer_id: "{{ application_id }}"

- name: "🧩 For '{{ application_id }}': Load sys-svc-compose"
  include_role:
    name: sys-svc-compose
  vars:
    compose_handlers_flush: false
    database_consumer_id: "{{ _sys_stk_backend_database_consumer_id }}"

- block:
    - name: "🔧 set sso_proxy_application_id (needed due to lazy-loading issue)"
      set_fact:
        sso_proxy_application_id: "{{ application_id }}"
    - name: "📄 render web-app-keycloak SSO-proxy sidecar config"
      include_tasks: "{{ lookup('path_absolute', 'roles/web-app-keycloak/tasks/sso_proxy.yml') }}"
  when: lookup('sso', application_id, 'is_proxy_gated') | bool

- name: "📂 For '{{ application_id }}': re-own the compose handler topics before the flush"
  ansible.builtin.include_role:
    name: sys-svc-compose
    tasks_from: none.yml
    handlers_from: main

- name: "🚿 flush compose and SSO proxy"
  meta: flush_handlers
  when: compose_handlers_flush | bool

- name: "🔑 For '{{ application_id }}': realign a dedicated postgres"
  include_tasks:
    file: "{{ lookup('path_absolute', 'roles/sys-svc-rdbms/tasks/utils/realign_dedicated_db.yml') }}"
    apply:
      delegate_to: "{{ STACK_HOST }}"
      run_once: true