---
- name: Deploy DetMir Grafana correctness check into Grafana CT
  hosts: proxmox
  become: true
  gather_facts: false

  vars:
    aw_repo_root: "{{ playbook_dir | dirname }}"
    aw_rust_release_dir: "{{ (lookup('env', 'CARGO_TARGET_DIR') | default(aw_repo_root + '/adk-rust/target', true)) + '/release' }}"
    grafana_check_ct_id: "{{ detmir_grafana_ct_id | default(201) }}"
    grafana_check_url: "{{ detmir_grafana_check_url | default('http://127.0.0.1:3000') }}"
    grafana_check_user: "{{ detmir_grafana_check_user | default(lookup('env', 'DETMIR_GRAFANA_USER') | default(lookup('env', 'GRAFANA_USER'), true), true) }}"
    grafana_check_password: "{{ detmir_grafana_check_password | default(lookup('env', 'DETMIR_GRAFANA_PASSWORD') | default(lookup('env', 'GRAFANA_PASSWORD'), true), true) }}"
    grafana_check_dashboard_uid: "{{ detmir_grafana_check_dashboard_uid | default('detmir-aw-main') }}"
    grafana_check_dashboard_file_src: "{{ aw_repo_root }}/grafana/detmir-aw-main-dashboard.json"
    grafana_check_dashboard_file_dest: /etc/grafana/provisioning/dashboards/aw/detmir-aw-main.json
    grafana_check_host: "{{ detmir_grafana_check_host | default('HOST-EXAMPLE') }}"
    grafana_check_max_freshness_minutes: "{{ detmir_grafana_check_max_freshness_minutes | default(360) }}"
    grafana_check_on_calendar: "{{ detmir_grafana_check_on_calendar | default('*:0/15') }}"

  tasks:
    - name: Validate Grafana check credentials
      ansible.builtin.assert:
        that:
          - grafana_check_user | length > 0
          - grafana_check_password | length > 0
        fail_msg: "Set DETMIR_GRAFANA_USER/DETMIR_GRAFANA_PASSWORD or detmir_grafana_check_user/password."
      no_log: true

    - name: Check local detmir-grafana-check binary
      ansible.builtin.stat:
        path: "{{ aw_rust_release_dir }}/detmir-grafana-check"
      delegate_to: localhost
      become: false
      register: grafana_check_binary

    - name: Fail when Rust binary is absent
      ansible.builtin.fail:
        msg: "Missing {{ aw_rust_release_dir }}/detmir-grafana-check. Build with cargo build --release -p detmir-grafana-check."
      when: not (grafana_check_binary.stat.exists | default(false))

    - name: Check local DetMir Grafana dashboard JSON
      ansible.builtin.stat:
        path: "{{ grafana_check_dashboard_file_src }}"
      delegate_to: localhost
      become: false
      register: grafana_check_dashboard

    - name: Fail when DetMir Grafana dashboard JSON is absent
      ansible.builtin.fail:
        msg: "Missing {{ grafana_check_dashboard_file_src }}."
      when: not (grafana_check_dashboard.stat.exists | default(false))

    - name: Copy detmir-grafana-check binary to Proxmox staging
      ansible.builtin.copy:
        src: "{{ aw_rust_release_dir }}/detmir-grafana-check"
        dest: /tmp/detmir-grafana-check
        owner: root
        group: root
        mode: "0755"

    - name: Install detmir-grafana-check into Grafana CT
      ansible.builtin.command:
        argv:
          - pct
          - push
          - "{{ grafana_check_ct_id }}"
          - /tmp/detmir-grafana-check
          - /usr/local/bin/detmir-grafana-check
      changed_when: true

    - name: Set Grafana check binary permissions in CT
      ansible.builtin.command:
        argv:
          - pct
          - exec
          - "{{ grafana_check_ct_id }}"
          - --
          - chmod
          - "0755"
          - /usr/local/bin/detmir-grafana-check
      changed_when: true

    - name: Copy DetMir Grafana dashboard JSON to Proxmox staging
      ansible.builtin.copy:
        src: "{{ grafana_check_dashboard_file_src }}"
        dest: /tmp/detmir-aw-main-dashboard.json
        owner: root
        group: root
        mode: "0644"

    - name: Ensure Grafana provisioning dashboard directory exists in CT
      ansible.builtin.command:
        argv:
          - pct
          - exec
          - "{{ grafana_check_ct_id }}"
          - --
          - install
          - "-d"
          - "-m"
          - "0755"
          - "{{ grafana_check_dashboard_file_dest | dirname }}"
      changed_when: true

    - name: Install DetMir Grafana dashboard JSON into CT provisioning
      ansible.builtin.command:
        argv:
          - pct
          - push
          - "{{ grafana_check_ct_id }}"
          - /tmp/detmir-aw-main-dashboard.json
          - "{{ grafana_check_dashboard_file_dest }}"
      changed_when: true

    - name: Create Grafana check runtime in CT
      ansible.builtin.command:
        argv:
          - pct
          - exec
          - "{{ grafana_check_ct_id }}"
          - --
          - install
          - "-d"
          - "-m"
          - "0755"
          - /var/lib/detmir-grafana-check
      changed_when: true

    - name: Install Grafana check env in CT
      ansible.builtin.shell: |
        set -euo pipefail
        pct exec {{ grafana_check_ct_id }} -- bash -lc 'umask 077; cat > /etc/detmir-grafana-check.env' <<'EOF'
        DETMIR_GRAFANA_URL={{ grafana_check_url }}
        DETMIR_GRAFANA_USER={{ grafana_check_user }}
        DETMIR_GRAFANA_PASSWORD={{ grafana_check_password }}
        DETMIR_GRAFANA_DASHBOARD_UID={{ grafana_check_dashboard_uid }}
        DETMIR_GRAFANA_DASHBOARD_FILE={{ grafana_check_dashboard_file_dest }}
        DETMIR_GRAFANA_HOST={{ grafana_check_host }}
        DETMIR_GRAFANA_MAX_FRESHNESS_MINUTES={{ grafana_check_max_freshness_minutes }}
        DETMIR_GRAFANA_OUTPUT_JSON=/var/lib/detmir-grafana-check/latest.json
        DETMIR_GRAFANA_OUTPUT_TEXT=/var/lib/detmir-grafana-check/latest.txt
        EOF
      args:
        executable: /bin/bash
      changed_when: true
      no_log: true

    - name: Install Grafana check service in CT
      ansible.builtin.shell: |
        set -euo pipefail
        pct exec {{ grafana_check_ct_id }} -- bash -lc 'cat > /etc/systemd/system/detmir-grafana-check.service' <<'EOF'
        [Unit]
        Description=DetMir Grafana dashboard data correctness check
        After=grafana-server.service network-online.target
        Wants=network-online.target

        [Service]
        Type=oneshot
        EnvironmentFile=/etc/detmir-grafana-check.env
        ExecStart=/usr/local/bin/detmir-grafana-check
        EOF
      args:
        executable: /bin/bash
      changed_when: true

    - name: Install Grafana check timer in CT
      ansible.builtin.shell: |
        set -euo pipefail
        pct exec {{ grafana_check_ct_id }} -- bash -lc 'cat > /etc/systemd/system/detmir-grafana-check.timer' <<'EOF'
        [Unit]
        Description=Run DetMir Grafana dashboard data correctness check

        [Timer]
        OnBootSec=2min
        OnCalendar={{ grafana_check_on_calendar }}
        Persistent=true
        RandomizedDelaySec=2min

        [Install]
        WantedBy=timers.target
        EOF
      args:
        executable: /bin/bash
      changed_when: true

    - name: Enable and run Grafana check timer in CT
      ansible.builtin.command:
        argv:
          - pct
          - exec
          - "{{ grafana_check_ct_id }}"
          - --
          - bash
          - "-lc"
          - systemctl daemon-reload && systemctl enable --now detmir-grafana-check.timer && systemctl start detmir-grafana-check.service
      changed_when: true

    - name: Verify Grafana check result in CT
      ansible.builtin.command:
        argv:
          - pct
          - exec
          - "{{ grafana_check_ct_id }}"
          - --
          - bash
          - "-lc"
          - test -s /var/lib/detmir-grafana-check/latest.json && jq -e '.ok == true and .counts.fail == 0' /var/lib/detmir-grafana-check/latest.json
      changed_when: false