- name: Bootstrap Proxmox API token for Ansible
  hosts: mini-pc
  gather_facts: false
  become: true
  vars:
    pve_api_user: ansible@pve
    pve_api_token_id: homelab
    pve_api_role: Administrator
  tasks:
    - name: Ensure Proxmox API user exists
      ansible.builtin.command: "pveum user add {{ pve_api_user }} --comment 'Ansible automation user'"
      register: pve_user_add
      changed_when: pve_user_add.rc == 0
      failed_when:
        - pve_user_add.rc != 0
        - "'already exists' not in (pve_user_add.stderr | lower)"

    - name: Grant Proxmox API user permissions
      ansible.builtin.command: "pveum aclmod / -user {{ pve_api_user }} -role {{ pve_api_role }}"
      changed_when: true

    - name: Remove old Ansible token if present
      ansible.builtin.command: "pveum user token remove {{ pve_api_user }} {{ pve_api_token_id }}"
      register: pve_token_remove
      changed_when: pve_token_remove.rc == 0
      failed_when: false
      no_log: true

    - name: Create Proxmox API token
      ansible.builtin.command: "pveum user token add {{ pve_api_user }} {{ pve_api_token_id }} --privsep 0 --comment 'HomeLab Ansible token' --output-format json"
      register: pve_token_add
      changed_when: true
      no_log: true

    - name: Store token data
      ansible.builtin.set_fact:
        pve_token_data: "{{ pve_token_add.stdout | from_json }}"
      no_log: true

    - name: Write local ansible/.env
      ansible.builtin.copy:
        dest: "{{ playbook_dir }}/../.env"
        mode: "0600"
        content: |
          export PROXMOX_HOST={{ ansible_host }}
          export PROXMOX_USER='{{ pve_api_user }}'
          export PROXMOX_TOKEN_ID='{{ pve_api_token_id }}'
          export PROXMOX_TOKEN_SECRET='{{ pve_token_data.value }}'
          export PROXMOX_VALIDATE_CERTS=false
          export PVE_LXC_OSTEMPLATE='local:vztmpl/debian-13-standard_13.0-1_amd64.tar.zst'
      delegate_to: localhost
      become: false
      no_log: true