---
- include_tasks: utils/once/flag.yml

- name: "✅ Assert {{ DIR_VAR_LIB }} is cluster-shared in swarm mode"
  ansible.builtin.assert:
    that:
      - (DEPLOYMENT_MODE == 'compose') or ('svc-swarm-node' not in group_names) or ('svc-storage-nfs-client' in group_names) or ('svc-storage-nfs-server' in
        group_names)
    fail_msg: >-
      sys-svc-mail-msmtp on a swarm member requires svc-storage-nfs-client
      so {{ DIR_VAR_LIB }} is cluster-shared. Set `storage.backend=nfs` and
      add this host to the `svc-storage-nfs-client` group, unless this host
      is the dedicated NFS server (svc-storage-nfs-server). Hosts outside
      the swarm (svc-swarm-node) keep a local {{ DIR_VAR_LIB }}.

- name: 📦 Install msmtp base package
  package_install:
    id: msmtp

- name: "📦 Install the CA trust store"
  package_install:
    id: ca-certificates

- name: ✅ Ensure the shared Root CA is trusted for the TLS mail relay
  include_role:
    name: sys-ca-selfsigned
  when:
    - (TLS_MODE | lower) == 'self_signed'
    - run_once_sys_ca_selfsigned is not defined

- name: "🔴 Disable SMTP to avoid port conflicts"
  include_tasks: "{{ lookup('path_absolute', 'roles/sys-svc-mail-smtp/tasks/disable.yml') }}"

- when: lookup('email').external | bool
  block:
    - name: 📦 Install msmtp-mta when Mailu is used and package exists on distro
      package_install:
        id: msmtp-mta
      register: sys_svc_mail_msmtp_mta

    - name: 📧 Provide sendmail compatibility link when msmtp-mta is unavailable
      file:
        src: /usr/bin/msmtp
        dest: /usr/bin/sendmail
        state: link
        force: true
      when: sys_svc_mail_msmtp_mta is skipped

- name: 🔧 configure msmtprc.conf.j2
  template: # nocheck: stack-host-template (per-host /root/.msmtprc, not stack-host-only)
    src: "msmtprc.conf.j2"
    dest: "/root/.msmtprc"
    mode: 600
  vars:
    sys_svc_mail_msmtp_in_container: false

- name: "🔄 Route hlth-msmtp via service-loader (after mailu compose-up)"
  ansible.builtin.include_role:
    name: sys-service-loader
    tasks_from: list_or_shoot.yml
  vars:
    list_or_shoot_roles:
      - sys-ctl-hlth-msmtp
  when: run_once_sys_ctl_hlth_msmtp is not defined