---
- name: Create and verify Vaultwarden backup before update
  hosts: vaultwarden
  gather_facts: false
  tasks:
    - name: Create a fresh Vaultwarden offsite backup
      ansible.builtin.command:
        argv:
          - systemctl
          - start
          - --wait
          - homelab-restic-offsite-vaultwarden.service
      changed_when: true

    - name: Run Vaultwarden offsite backup audit
      ansible.builtin.command:
        argv:
          - systemctl
          - start
          - --wait
          - homelab-backup-audit-vaultwarden.service
      changed_when: true

- name: Create and verify Vaultwarden PBS backup before update
  hosts: mini-pc
  gather_facts: false
  vars:
    vaultwarden_vmid: "{{ homelab_services['vaultwarden'].vmid }}"
  tasks:
    - name: Read existing Vaultwarden VMID configuration
      ansible.builtin.command: "pct config {{ vaultwarden_vmid }}"
      register: vaultwarden_existing_vmid
      changed_when: false

    - name: Refuse to modify a foreign Vaultwarden VMID
      ansible.builtin.assert:
        that:
          - vaultwarden_existing_vmid.rc == 0
          - vaultwarden_existing_hostname == 'vaultwarden'
        fail_msg: >-
          VMID {{ vaultwarden_vmid }} from the service registry is not the
          Vaultwarden container.
      vars:
        vaultwarden_existing_hostname: >-
          {{ vaultwarden_existing_vmid.stdout_lines
             | select('match', '^hostname: ')
             | map('regex_replace', '^hostname: ', '')
             | first
             | default('') }}

    - name: Check for active Proxmox backup before Vaultwarden PBS backup
      ansible.builtin.command: pgrep -x vzdump
      register: vaultwarden_vzdump_preflight
      changed_when: false
      failed_when: false

    - name: Require no active Proxmox backup before Vaultwarden PBS backup
      ansible.builtin.assert:
        that:
          - vaultwarden_vzdump_preflight.rc != 0
        fail_msg: >-
          A Proxmox backup is already running on mini-pc.
          Retry after the existing backup completes.

    - name: Create a fresh Vaultwarden PBS backup
      ansible.builtin.command:
        argv:
          - vzdump
          - "{{ vaultwarden_vmid }}"
          - --storage
          - pbs
          - --mode
          - snapshot
          - --exclude-path
          - /var/lib/docker/fuse-overlayfs/*/merged

    - name: Run current PBS backup audit on mini-pc
      ansible.builtin.command:
        argv:
          - systemctl
          - start
          - --wait
          - homelab-backup-audit-pbs.service
      changed_when: true

- import_playbook: pve-vaultwarden.yml
  vars:
    pve_provisioning_enabled: false

- name: Verify Vaultwarden public endpoint after update
  hosts: ru-vps
  gather_facts: false
  tasks:
    - name: Check Vaultwarden HTTPS endpoint
      ansible.builtin.uri:
        url: https://pass.ada-dev.ru/
        status_code: 200
        return_content: false
      register: vaultwarden_public_health
      retries: 24
      delay: 5
      until: vaultwarden_public_health.status == 200