---
- name: Create and verify current PBS audit before AdGuard update
  hosts: mini-pc
  gather_facts: false
  vars:
    adguard_vmid: "{{ homelab_services['adguard'].vmid }}"
  tasks:
    - name: Verify AdGuard VMID ownership before backup
      ansible.builtin.command: "pct config {{ adguard_vmid }}"
      register: adguard_pct_config
      changed_when: false
      failed_when: false

    - name: Refuse to back up a foreign AdGuard VMID
      ansible.builtin.assert:
        that:
          - adguard_pct_config.rc == 0
          - adguard_existing_hostname == 'adguard'
        fail_msg: >-
          VMID {{ adguard_vmid }} from the service registry is not the
          AdGuard container.
      vars:
        adguard_existing_hostname: >-
          {{ adguard_pct_config.stdout_lines
             | select('match', '^hostname: ')
             | map('regex_replace', '^hostname: ', '')
             | first
             | default('') }}

    - name: Check for active Proxmox backup before AdGuard PBS backup
      ansible.builtin.command: pgrep -x vzdump
      register: adguard_vzdump_preflight
      changed_when: false
      failed_when: false

    - name: Require no active Proxmox backup before AdGuard PBS backup
      ansible.builtin.assert:
        that:
          - adguard_vzdump_preflight.rc != 0
        fail_msg: >-
          A Proxmox backup is already running on mini-pc.
          Retry after the existing backup completes.

    - name: Create a fresh AdGuard PBS backup
      ansible.builtin.command:
        argv:
          - vzdump
          - "{{ adguard_vmid }}"
          - --storage
          - pbs
          - --mode
          - snapshot
          - --exclude-path
          - /var/lib/docker/fuse-overlayfs/*/merged

    - name: Run current PBS audit service
      ansible.builtin.command:
        argv:
          - systemctl
          - start
          - --wait
          - homelab-backup-audit-pbs.service
      changed_when: true

- import_playbook: pve-adguard.yml

- name: Verify AdGuard public services after update
  hosts: adguard
  gather_facts: false
  tasks:
    - name: Check AdGuard HTTP root
      ansible.builtin.uri:
        url: http://127.0.0.1/
        status_code: [200, 302]
        return_content: false
      register: adguard_http_root_check
      retries: 24
      delay: 5
      until: adguard_http_root_check.status in [200, 302]

    - name: Check AdGuard DNS over UDP
      ansible.builtin.command:
        argv:
          - dig
          - "@127.0.0.1"
          - localhost
          - A
          - +time=2
          - +tries=1
          - +short
      register: adguard_dns_udp_check
      changed_when: false
      retries: 12
      delay: 5
      until: adguard_dns_udp_check.rc == 0 and '127.0.0.1' in adguard_dns_udp_check.stdout

    - name: Check AdGuard DNS over TCP
      ansible.builtin.command:
        argv:
          - dig
          - "@127.0.0.1"
          - localhost
          - A
          - +tcp
          - +time=2
          - +tries=1
          - +short
      register: adguard_dns_tcp_check
      changed_when: false
      retries: 12
      delay: 5
      until: adguard_dns_tcp_check.rc == 0 and '127.0.0.1' in adguard_dns_tcp_check.stdout