---
- name: Bootstrap emergency bot control identity
  ansible.builtin.import_tasks: bootstrap.yml

- name: Validate emergency bot inputs
  ansible.builtin.assert:
    that:
      - emergency_bot_token is match('^[0-9]+:[A-Za-z0-9_-]+$')
      - emergency_bot_allowed_user_ids is match('^[0-9]+(,[0-9]+)*$')
      - emergency_mini_pc_host_key is match('^ssh-(ed25519|rsa|ecdsa-[^ ]+) [A-Za-z0-9+/=]+( [A-Za-z0-9@._:-]+)?$')
    fail_msg: Set EMERGENCY_BOT_TOKEN, EMERGENCY_ALLOWED_USER_IDS and EMERGENCY_MINI_PC_HOST_KEY.
  no_log: true

- name: Install emergency bot dependencies
  ansible.builtin.apt:
    name:
      - ca-certificates
      - openssh-client
      - python3
    state: present
    update_cache: true

- name: Create emergency bot configuration directory
  ansible.builtin.file:
    path: "{{ emergency_bot_config_dir }}"
    state: directory
    owner: root
    group: root
    mode: "0755"

- name: Pin mini-pc SSH host key
  ansible.builtin.copy:
    dest: "{{ emergency_bot_state_dir }}/known_hosts"
    content: "mini-pc-emergency {{ emergency_mini_pc_host_key }}\n"
    owner: "{{ emergency_bot_user }}"
    group: "{{ emergency_bot_user }}"
    mode: "0600"
  no_log: true

- name: Install emergency bot runtime
  ansible.builtin.template:
    src: emergency_bot.py.j2
    dest: /usr/local/libexec/emergency-bot
    owner: root
    group: root
    mode: "0755"
  notify: Restart emergency bot

- name: Install emergency bot environment
  ansible.builtin.template:
    src: emergency-bot.env.j2
    dest: "{{ emergency_bot_config_dir }}/bot.env"
    owner: root
    group: root
    mode: "0600"
  no_log: true
  notify: Restart emergency bot

- name: Install emergency bot systemd unit
  ansible.builtin.template:
    src: emergency-bot.service.j2
    dest: /etc/systemd/system/emergency-bot.service
    owner: root
    group: root
    mode: "0644"
  notify:
    - Reload systemd
    - Restart emergency bot

- name: Enable and start emergency bot
  ansible.builtin.meta: flush_handlers

- name: Enable and start emergency bot
  ansible.builtin.systemd_service:
    name: emergency-bot.service
    enabled: true
    state: started