- name: Configure Gitea reverse proxy on ru-vps
  hosts: ru-vps
  gather_facts: false
  vars:
    caddy_dir: /opt/services/ru-vps/caddy
    caddyfile_path: /opt/services/ru-vps/caddy/Caddyfile
    gitea_domain: git.ada-dev.ru
    gitea_upstream: 192.168.1.25:3000

  tasks:
    - name: Ensure Caddy service directory exists
      ansible.builtin.file:
        path: "{{ caddy_dir }}"
        state: directory
        owner: root
        group: root
        mode: "0755"

    - name: Configure Gitea Caddy site
      ansible.builtin.blockinfile:
        path: "{{ caddyfile_path }}"
        create: true
        owner: root
        group: root
        mode: "0644"
        marker: "# {mark} ANSIBLE MANAGED GITEA SITE"
        block: |
          {{ gitea_domain }} {
            reverse_proxy {{ gitea_upstream }}
          }
      register: gitea_caddy_site

    - name: Remove legacy unmanaged Gitea Caddy site
      ansible.builtin.replace:
        path: "{{ caddyfile_path }}"
        regexp: '(?ms)^git\.ada-dev\.ru \{\n\s*reverse_proxy 10\.122\.62\.51:3002\n\}\n+'
        replace: ''
      register: gitea_legacy_site

    - name: Validate host Caddy config
      ansible.builtin.command: caddy validate --config {{ caddyfile_path }}
      changed_when: false

    - name: Check Caddy container mounted config
      ansible.builtin.command: docker exec caddy grep -F 'reverse_proxy {{ gitea_upstream }}' /etc/caddy/Caddyfile
      register: gitea_container_caddyfile
      changed_when: false
      failed_when: false

    - name: Restart Caddy when config changed or bind mount is stale
      ansible.builtin.command: docker restart caddy
      when: >-
        gitea_caddy_site.changed or
        gitea_legacy_site.changed or
        gitea_container_caddyfile.rc != 0

    - name: Validate Caddy container config after restart
      ansible.builtin.command: docker exec caddy caddy validate --config /etc/caddy/Caddyfile
      changed_when: false

    - name: Check Gitea upstream from ru-vps
      ansible.builtin.command: curl -fsS -o /dev/null -w '%{http_code}' http://{{ gitea_upstream }}/
      register: gitea_upstream_http
      changed_when: false
      failed_when: gitea_upstream_http.stdout != '200'