---
# The Great Bear — rootless Podman + Quadlet, behind the fleet's shared Caddy
# unit (caddy/playbook.yml in the ansible-playbooks repo).
#
# Connects as the container user and runs everything as that user: the Quadlet
# units belong to it, so the connection's PAM session is what makes
# `systemctl --user` and `podman exec` work without any environment juggling.
# There is deliberately no `become`: root-only prerequisites (Podman,
# `loginctl enable-linger`, the low-port sysctl Caddy needs) belong to
# caddy/playbook.yml, which must have run on this host first.
#
# gather_facts is required: podman_user, podman_data_dir and quadlet_dir are
# derived from the user_id / user_dir facts.
#
# Run with: ansible-playbook -u tanshu playbook.yml
- name: Deploy The Great Bear as a rootless Podman Quadlet
  hosts: emily
  gather_facts: true
  vars_files:
    - vars/default.yml

  pre_tasks:
    # This must happen before the app unit is started, not after: the generated
    # greatbear.container references {{ network_name }}.network, and Quadlet
    # fails *unit generation* (so `systemctl --user start` reports "unit not
    # found") when a referenced .network file does not exist yet. The same
    # include writes the drop-in that attaches the shared Caddy unit to this
    # network, which is what makes `greatbear` resolvable to Caddy.
    - name: Register The Great Bear's network with Caddy
      ansible.builtin.include_tasks: "{{ playbook_dir }}/roles/register/tasks/main.yaml"

  roles:
    # The app: data directory, .env, the Quadlet unit, start + healthcheck.
    - greatbear
    # Appends this site's blocks to the shared Caddyfile and reloads Caddy.
    - caddy