---
- name: "🔍 Resolve {{ application_id }} hosting node + container id"
  ansible.builtin.include_tasks: "{{ lookup('path_absolute', 'roles/sys-svc-compose/tasks/utils/swarm/resolve_host_cid.yml') }}"
  vars:
    resolve_service_key: gitea
    resolve_output_prefix: GITEA
    resolve_compose_cid: "{{ GITEA_CONTAINER_ADDRESS }}"

- name: ⏳ Wait for Gitea HTTP endpoint
  ansible.builtin.shell: >- # nocheck: container-exec-resolver  runtime-resolved CID, delegated to the hosting node
    container exec {{ GITEA_LOCAL_CID | quote }}
    {{ 10 | curl(retries=0) }} -S -o /dev/null {{ GITEA_LOOPBACK_VERSION_URL | quote }}
  delegate_to: "{{ GITEA_HOST_NODE }}"
  register: gitea_http_ready
  changed_when: false
  retries: "{{ ((lookup('timeout', 300) | int) / 5) | round(0, 'ceil') | int }}"
  delay: 5
  until: gitea_http_ready.rc == 0

- name: "⏳ Wait for Gitea app.ini to be present after redeploy"
  shell: | # nocheck: container-exec-resolver  runtime-resolved CID, delegated to the hosting node
    container exec -i --user {{ GITEA_USER }} {{ GITEA_LOCAL_CID | quote }} \
      test -f {{ GITEA_CONFIG }}
  delegate_to: "{{ GITEA_HOST_NODE }}"
  register: gitea_config_ready
  changed_when: false
  retries: 30
  delay: 2
  until: gitea_config_ready.rc == 0

- name: "▶️ Run DB migrations inside Gitea container"
  shell: | # nocheck: container-exec-resolver  runtime-resolved CID, delegated to the hosting node
    container exec -i --user {{ GITEA_USER }} {{ GITEA_LOCAL_CID | quote }} \
      /app/gitea/gitea migrate -c {{ GITEA_CONFIG }}
  delegate_to: "{{ GITEA_HOST_NODE }}"
  register: migrate
  changed_when: "'migrations completed' in migrate.stdout"

- name: "📁 Create initial admin user"
  no_log: "{{ MASK_CREDENTIALS_IN_LOGS | bool }}"
  shell: | # nocheck: container-exec-resolver  runtime-resolved CID, delegated to the hosting node
    container exec -i --user {{ GITEA_USER }} {{ GITEA_LOCAL_CID | quote }} \
      /app/gitea/gitea admin user create \
        --admin \
        --username "{{ lookup('users', 'administrator').username }}" \
        --password {{ lookup('users', 'administrator').password | quote }} \
        --email    "{{ lookup('users', 'administrator').email }}" \
        -c {{ GITEA_CONFIG }}
  delegate_to: "{{ GITEA_HOST_NODE }}"
  register: create_admin
  changed_when: "'has been successfully created' in create_admin.stdout"
  failed_when: create_admin.rc != 0 and 'user already exists' not in create_admin.stderr

- name: "⏳ Wait until Gitea setup and migrations are ready"
  ansible.builtin.shell: >- # nocheck: container-exec-resolver  runtime-resolved CID, delegated to the hosting node
    container exec {{ GITEA_LOCAL_CID | quote }}
    {{ 10 | curl(retries=0) }} -fS -o /dev/null {{ GITEA_LOOPBACK_VERSION_URL | quote }}
  delegate_to: "{{ GITEA_HOST_NODE }}"
  register: gitea_ready
  changed_when: false
  until: gitea_ready.rc == 0
  retries: 20
  delay: 5
  when: (GITEA_OIDC_ENABLED | bool) or (GITEA_LDAP_ENABLED | bool)

- name: ▶️ Execute Setup Routines
  include_tasks: 02_setup.yml

- name: ▶️ Execute Cleanup Routines
  include_tasks: 03_cleanup.yml
  when: MODE_CLEANUP | bool

- name: "🔌 Provision the MCP surface"
  include_tasks: utils/mcp.yml
  when: GITEA_MCP_ENABLED | bool

- name: 📂 Include DNS role to register Gitea domain(s)
  include_role:
    name: sys-dns-cloudflare-records
  vars:
    cloudflare_records:
      - zone: "{{ lookup('domain',application_id) | to_zone }}"
        type: A
        name: "{{ lookup('domain',application_id) }}"
        content: "{{ networks.internet.ip4 }}"
        proxied: false
  when: DNS_PROVIDER == 'cloudflare'