---
- name: Ensure DLP integrations directory
  ansible.builtin.file:
    path: /opt/activitywatch/dlp-integrations
    state: directory
    owner: "{{ aw_server_user | default('activitywatch') }}"
    group: "{{ aw_server_group | default('activitywatch') }}"
    mode: "0755"

- name: Copy DLP integrations files
  ansible.builtin.copy:
    src: "{{ playbook_dir }}/../aw-server/dlp-integrations/{{ item }}"
    dest: "/opt/activitywatch/dlp-integrations/{{ item }}"
    owner: "{{ aw_server_user | default('activitywatch') }}"
    group: "{{ aw_server_group | default('activitywatch') }}"
    mode: "0644"
  loop:
    - cef_exporter.py
    - syslog_forwarder.py
    - webhook_sender.py
    - cef-config.yaml
    - syslog-forwarder-config.yaml
    - webhook-config.yaml
    - requirements.txt

- name: Make DLP integrations scripts executable
  ansible.builtin.file:
    path: "/opt/activitywatch/dlp-integrations/{{ item }}"
    owner: "{{ aw_server_user | default('activitywatch') }}"
    group: "{{ aw_server_group | default('activitywatch') }}"
    mode: "0755"
  loop:
    - cef_exporter.py
    - syslog_forwarder.py
    - webhook_sender.py

- name: Create venv for DLP integrations
  ansible.builtin.command:
    cmd: python3 -m venv /opt/activitywatch/dlp-integrations/.venv
  args:
    creates: /opt/activitywatch/dlp-integrations/.venv/bin/python

- name: Install Python dependencies for DLP integrations
  ansible.builtin.pip:
    requirements: /opt/activitywatch/dlp-integrations/requirements.txt
    virtualenv: /opt/activitywatch/dlp-integrations/.venv

- name: Ensure integrations state directory
  ansible.builtin.file:
    path: /var/lib/activitywatch/dlp-integrations
    state: directory
    owner: "{{ aw_server_user | default('activitywatch') }}"
    group: "{{ aw_server_group | default('activitywatch') }}"
    mode: "0755"

- name: Install systemd units/timers for DLP integrations
  ansible.builtin.copy:
    src: "{{ playbook_dir }}/../aw-server/dlp-integrations/{{ item.src }}"
    dest: "{{ item.dest }}"
    owner: root
    group: root
    mode: "0644"
  loop:
    - { src: "cef-exporter.service", dest: "/etc/systemd/system/aw-dlp-cef-exporter.service" }
    - { src: "cef-exporter.timer", dest: "/etc/systemd/system/aw-dlp-cef-exporter.timer" }
    - { src: "syslog-forwarder.service", dest: "/etc/systemd/system/aw-dlp-syslog-forwarder.service" }
    - { src: "syslog-forwarder.timer", dest: "/etc/systemd/system/aw-dlp-syslog-forwarder.timer" }
    - { src: "webhook-sender.service", dest: "/etc/systemd/system/aw-dlp-webhook-sender.service" }
    - { src: "webhook-sender.timer", dest: "/etc/systemd/system/aw-dlp-webhook-sender.timer" }

- name: Check local Rust CEF exporter
  ansible.builtin.stat:
    path: "{{ playbook_dir }}/../adk-rust/target/release/dlp-cef-exporter"
  delegate_to: localhost
  register: dlp_cef_exporter_rust_binary
  become: false

- name: Install Rust CEF exporter
  ansible.builtin.copy:
    src: "{{ playbook_dir }}/../adk-rust/target/release/dlp-cef-exporter"
    dest: /usr/local/bin/dlp-cef-exporter-rust
    owner: root
    group: root
    mode: "0755"
  when: dlp_cef_exporter_rust_binary.stat.exists | default(false)

- name: Ensure CEF exporter drop-in directory
  ansible.builtin.file:
    path: /etc/systemd/system/aw-dlp-cef-exporter.service.d
    state: directory
    owner: root
    group: root
    mode: "0755"
  when: dlp_cef_exporter_rust_binary.stat.exists | default(false)

- name: Switch CEF exporter to Rust
  ansible.builtin.copy:
    dest: /etc/systemd/system/aw-dlp-cef-exporter.service.d/20-rust-switch.conf
    owner: root
    group: root
    mode: "0644"
    content: |
      [Service]
      ExecStart=
      ExecStart=/usr/local/bin/dlp-cef-exporter-rust
  when: dlp_cef_exporter_rust_binary.stat.exists | default(false)

- name: Check local Rust syslog forwarder
  ansible.builtin.stat:
    path: "{{ playbook_dir }}/../adk-rust/target/release/dlp-syslog-forwarder"
  delegate_to: localhost
  register: dlp_syslog_forwarder_rust_binary
  become: false

- name: Install Rust syslog forwarder
  ansible.builtin.copy:
    src: "{{ playbook_dir }}/../adk-rust/target/release/dlp-syslog-forwarder"
    dest: /usr/local/bin/dlp-syslog-forwarder-rust
    owner: root
    group: root
    mode: "0755"
  when: dlp_syslog_forwarder_rust_binary.stat.exists | default(false)

- name: Ensure syslog forwarder drop-in directory
  ansible.builtin.file:
    path: /etc/systemd/system/aw-dlp-syslog-forwarder.service.d
    state: directory
    owner: root
    group: root
    mode: "0755"
  when: dlp_syslog_forwarder_rust_binary.stat.exists | default(false)

- name: Switch syslog forwarder to Rust
  ansible.builtin.copy:
    dest: /etc/systemd/system/aw-dlp-syslog-forwarder.service.d/20-rust-switch.conf
    owner: root
    group: root
    mode: "0644"
    content: |
      [Service]
      ExecStart=
      ExecStart=/usr/local/bin/dlp-syslog-forwarder-rust
  when: dlp_syslog_forwarder_rust_binary.stat.exists | default(false)

- name: Check local Rust webhook sender
  ansible.builtin.stat:
    path: "{{ playbook_dir }}/../adk-rust/target/release/dlp-webhook-sender"
  delegate_to: localhost
  register: dlp_webhook_sender_rust_binary
  become: false

- name: Install Rust webhook sender
  ansible.builtin.copy:
    src: "{{ playbook_dir }}/../adk-rust/target/release/dlp-webhook-sender"
    dest: /usr/local/bin/dlp-webhook-sender-rust
    owner: root
    group: root
    mode: "0755"
  when: dlp_webhook_sender_rust_binary.stat.exists | default(false)

- name: Ensure webhook sender drop-in directory
  ansible.builtin.file:
    path: /etc/systemd/system/aw-dlp-webhook-sender.service.d
    state: directory
    owner: root
    group: root
    mode: "0755"
  when: dlp_webhook_sender_rust_binary.stat.exists | default(false)

- name: Switch webhook sender to Rust
  ansible.builtin.copy:
    dest: /etc/systemd/system/aw-dlp-webhook-sender.service.d/20-rust-switch.conf
    owner: root
    group: root
    mode: "0644"
    content: |
      [Service]
      ExecStart=
      ExecStart=/usr/local/bin/dlp-webhook-sender-rust
  when: dlp_webhook_sender_rust_binary.stat.exists | default(false)

- name: Reload systemd
  ansible.builtin.systemd:
    daemon_reload: true

- name: Enable and restart DLP integration timers
  ansible.builtin.systemd:
    name: "{{ item }}"
    enabled: true
    state: restarted
  loop:
    - aw-dlp-cef-exporter.timer
    - aw-dlp-syslog-forwarder.timer
    - aw-dlp-webhook-sender.timer
