---
# Vaultwarden (the Bitwarden-compatible server) as a rootless Podman Quadlet
# unit, behind the shared Caddy unit (caddy/playbook.yml) and with its data in
# the shared Postgres unit (postgres/playbook.yml).
#
# Connects as the container user and runs everything as that user: the Quadlet
# units belong to it, so the connection's PAM session is what makes
# `systemctl --user` work without any environment juggling.
#
# gather_facts is required: podman_user and the home directory come from the
# user_id / user_dir facts.
#
# The rootless-Podman prerequisites (installing podman, enabling lingering, the
# low-port sysctl, creating the Quadlet directory) are deliberately NOT applied
# here. They are the shared task file at caddy/roles/podman/tasks/main.yaml, and
# a host that has already run caddy/playbook.yml has them:
#
#   - name: Rootless Podman prerequisites
#     ansible.builtin.include_tasks: "{{ playbook_dir }}/../caddy/roles/podman/tasks/main.yaml"
#
# The variables this play needs are duplicated at the top of vars/default.yml, so
# it stands on its own.
#
# Run with: ansible-playbook -u tanshu bitwarden/playbook.yml
- name: Deploy Vaultwarden as a rootless Podman Quadlet
  hosts: emily
  gather_facts: true
  vars_files:
    - vars/default.yml

  pre_tasks:
    # This must happen before the app unit is started, not after: the generated
    # unit references {{ network_name }}.network, and Quadlet fails *unit
    # generation* (so `systemctl --user start` reports "unit not found") when a
    # referenced .network file does not exist yet. The same include writes the
    # Caddy-side drop-in that attaches Caddy to this network, and the Postgres
    # attach below needs the network unit to exist as well.
    #
    # network_name is a play var, so the include can see it directly.
    - name: Register Bitwarden's network with Caddy
      ansible.builtin.include_tasks: "{{ playbook_dir }}/../caddy/roles/register/tasks/main.yaml"

  roles:
    # Attaches this app's network to the shared Postgres unit, which is what
    # makes DATABASE_URL's host resolve, and owns the "Restart Postgres" handler
    # that postgres/roles/attach notifies. Runs first so the database is
    # reachable before the app starts.
    - postgres
    # The app: data directory, the 0600 environment file, the Quadlet unit,
    # start + verify.
    - bitwarden
    # Appends this site's block to the shared Caddyfile and reloads Caddy.
    - caddy