---
# Nextcloud as a rootless Podman Quadlet unit, behind the shared Caddy, with its
# database in the shared Postgres and its cache in the shared Valkey. Each of
# those is its own playbook and has to have been run first: caddy, postgres,
# valkey, then this.
#
# Idempotent and standalone: the first run creates and starts the container (a
# fresh webroot then serves the setup wizard), and later runs converge it —
# Quadlet recreates the container when the unit or its environment changes.
#
# Runs as the connection user with no become: the units belong to that user, so
# the SSH session's own PAM session is what makes `systemctl --user` work.
# gather_facts is required — podman_user and the home directory come from the
# user_id / user_dir facts.
#
# The rootless-Podman prerequisites (podman, lingering, the low-port sysctl, the
# Quadlet directory) are not applied here; they are the shared task file at
# caddy/roles/podman, and a host that has run caddy/playbook.yml has them.
#
# Run with: ansible-playbook -u tanshu nextcloud/playbook.yml
- name: Deploy Nextcloud as a rootless Podman Quadlet
  hosts: emily
  gather_facts: true
  vars_files:
    - vars/default.yml

  pre_tasks:
    # This must happen before the app unit is started, not after: the generated
    # unit references {{ network_name }}.network, and Quadlet fails *unit
    # generation* (so `systemctl --user start` reports "unit not found") when a
    # referenced .network file does not exist yet. The same include writes the
    # Caddy-side drop-in that attaches Caddy to this network, and both attaches
    # below need the network unit to exist as well.
    #
    # network_name is a play var, so the include can see it directly.
    - name: Register Nextcloud's network with Caddy
      ansible.builtin.include_tasks: "{{ playbook_dir }}/../caddy/roles/register/tasks/main.yaml"

  roles:
    # Attaches this app's network to the shared Postgres unit, which is what
    # makes config.php's `db` host resolve, and owns the "Restart Postgres"
    # handler that postgres/roles/attach notifies. Runs first so the database is
    # reachable before the app starts.
    - postgres
    # The same at the cache end: attaches this app's network to the shared Valkey
    # unit, which is what makes config.php's `redis` host resolve, and owns the
    # "Restart Valkey" handler that valkey/roles/attach notifies.
    - valkey
    # The app: the webroot, the 0600 environment file, the Quadlet unit, the
    # background-job timer, start + verify.
    - nextcloud
    # Appends this site's block to the shared Caddyfile and reloads Caddy.
    - caddy