---
- name: "⏳ Wait until Greenlight is reachable via Nginx"
  uri_retry:
    url: "{{ lookup('tls', application_id, 'url.base') }}"
    validate_certs: true
    status_code: 200
    return_content: true
  register: greenlight_http
  until:
    - greenlight_http.status == 200
    - "'Greenlight' in greenlight_http.content or 'Sign in' in greenlight_http.content"
  retries: 30
  delay: 5
  changed_when: false

- name: "✅ Ensure Greenlight admin (B64-safe, idempotent)"
  ansible.builtin.command:
    argv:
      - container
      - exec
      - -i
      - -e
      - "TARGET_NAME={{ lookup('users', 'administrator').username | upper }}"
      - -e
      - "NEW_NAME={{ lookup('users', 'administrator').username | upper }}"
      - -e
      - "NEW_EMAIL={{ lookup('users', 'administrator').email }}"
      - -e
      - "NEW_PASSWORD_B64={{ lookup('users', 'administrator').password | b64encode }}"
      - "{{ BBB_GREENLIGHT_CONTAINER_ADDRESS | quote }}" # nocheck: container-address-quote, container-address-needs-shell  compose_mode_force role, so the lookup can only yield a bare name
      - bash
      - -lc
      - "bundle exec rails runner -"
    stdin: "{{ lookup('ansible.builtin.file', role_path ~ '/files/ruby/greenlight_ensure_admin.rb') }}"
  register: greenlight_admin_map
  changed_when: "'CHANGED' in greenlight_admin_map.stdout"
  failed_when: greenlight_admin_map.rc != 0
  no_log: "{{ MASK_CREDENTIALS_IN_LOGS | bool }}"