---
- name: Deploy LXC
  hosts: localhost
  remote_user: ansible
  gather_facts: false

  vars_files:
    ../inventory/group_vars/all/secrets.yaml
  vars:
    ansible_user_passwd_hash: "{{ ansible_password | password_hash('sha512', 's3edscrj45e6r') }}"
    user_passwd_hash: "{{ user_password | password_hash('sha512', 's3ed6123jhgcr') }}"

  vars_prompt:
    - name: lxc_hostname
      prompt: "Hostname for the container (may only contain letters (a-z, A-Z), numbers (0-9), and hyphens)"
      default: "new-lxc-test"
      private: false

    - name: lxc_root_password
      prompt: "Root password"
      default: "new-lxc-test"
      private: true
      confirm: true
      encrypt: sha512_crypt

    - name: lxc_ip_address
      prompt: "IP address for the container (in x.x.x.x/x formant)"
      default: "192.168.0.90/24"
      private: false

    - name: lxc_is_privileged
      prompt: "Unprivileged LXC (true/false)?"
      default: true
      private: false

    - name: lxc_create_human_admin_user
      prompt: "Create human admin user? (true/false)?"
      default: true
      private: false

  pre_tasks:
    - name: Validate hostname
      ansible.builtin.fail:
        msg: |
          Invalid hostname: "{{ lxc_hostname }}"
          Hostname must:
            - contain only letters (a-z, A-Z), digits (0-9), hyphens (-), and dots (.)
            - not start or end with a hyphen or dot
            - have each label between 1 and 63 characters
            - not exceed 253 characters in total
      when: >
        lxc_hostname | length > 253 or
        lxc_hostname is not regex('^[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?(?:\.[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?)*$')
      run_once: true

    - name: Validate IP address
      ansible.builtin.fail:
        msg: |
          Invalid IP address: "{{ lxc_ip_address }}"
          IP address must be in x.x.x.x/x format (e.g., 192.168.0.90/24).
      when: not lxc_ip_address is regex('^((25[0-5]|2[0-4]\\d|[01]?\\d\\d?)\\.){3}(25[0-5]|2[0-4]\\d|[01]?\\d\\d?)(\\/(3[0-2]|[12]?\\d))?$')
      run_once: true

  roles:
    - ../roles/deploy_lxc_on_proxmox 

  tasks:
    - name: Make the prompted hostname available to the whole playbook
      ansible.builtin.set_fact:
        fact_lxc_hostname: "{{ lxc_hostname }}"

    - name: Make the prompted IP available to the whole playbook
      ansible.builtin.set_fact:
        fact_lxc_ip_address: "{{ lxc_ip_address.split('/') | first }}"

    - name: Make the "human admin user" selection available to the whole playbook
      ansible.builtin.set_fact:
        fact_lxc_create_human_admin_user: "{{ lxc_create_human_admin_user }}"

    - name: Add the target host to the inventory
      ansible.builtin.add_host:
        name: "{{ fact_lxc_ip_address }}"
        groups: new_host
        ansible_user: ansible
        ansible_become_password: "{{ ansible_become_passwd }}"


- name: Configure LXC
  hosts: new_host
  remote_user: ansible

  vars_files:
    ../inventory/group_vars/all/secrets.yaml
  vars:
    ansible_user_passwd_hash: "{{ ansible_password | password_hash('sha512', 's3edscrj45e6r') }}"
    user_passwd_hash: "{{ user_password | password_hash('sha512', 's3ed6123jhgcr') }}"

  roles:
    - ../roles/configure_ansible_user 
    - ../roles/harden_ssh 
    - ../roles/base_system

  tasks:
    - name: Include human admin user role
      ansible.builtin.include_role:
        name: ../roles/human_admin_user
      when: "hostvars['localhost']['fact_lxc_create_human_admin_user'] | bool"

    - name: Include update configs role
      ansible.builtin.include_role:
        name: ../roles/update_configs
      when: "hostvars['localhost']['fact_lxc_create_human_admin_user'] | bool"