---
- name: Deploy VM
  hosts: localhost
  remote_user: ansible
  gather_facts: false

  vars_files:
    ../inventory/group_vars/all/secrets.yaml
  vars:
    ansible_user_passwd_hash: "{{ ansible_password | password_hash('sha512', 's3edscrj45e6r') }}"
    user_passwd_hash: "{{ user_password | password_hash('sha512', 's3ed6123jhgcr') }}"

  vars_prompt:
    - name: vm_hostname
      prompt: "Hostname for the VM (may only contain letters (a-z, A-Z), numbers (0-9), and hyphens)"
      default: "new-vm-test"
      private: false

    - name: vm_os_template
      prompt: "Select OS template. Available: debian-13 | alpine"
      default: "debian-13"
      private: false
    
    - name: vm_become_method
      prompt: "Select become method. Available: sudo | su | pbrun | pfexec | doas | dzdo | ksu | runas | machinectl"
      default: "sudo"
      private: false

    - name: vm_ip_address
      prompt: "IP address for the VM (in x.x.x.x/x formant)"
      default: "192.168.0.89/24"
      private: false

  pre_tasks:
    - name: Validate hostname
      ansible.builtin.fail:
        msg: |
          Invalid hostname: "{{ vm_hostname }}"
          Hostname may only contain letters (a-z, A-Z), numbers (0-9), and hyphens (-).
      when: not vm_hostname is regex('^[a-zA-Z0-9-]+$')
      run_once: true

    - name: Validate IP address
      ansible.builtin.fail:
        msg: |
          Invalid IP address: "{{ vm_ip_address }}"
          IP address must be in x.x.x.x/x format (e.g., 192.168.0.89/24).
      when: not vm_ip_address is regex('^((25[0-5]|2[0-4]\\d|[01]?\\d\\d?)\\.){3}(25[0-5]|2[0-4]\\d|[01]?\\d\\d?)(\\/(3[0-2]|[12]?\\d))?$')
      run_once: true

    - name: Validate OS template
      ansible.builtin.fail:
        msg: |
          Invalid OS template: "{{ vm_os_template }}"
          Select from available options: debian-13, alpine 
      when: vm_os_template not in ['debian-13', 'alpine']
      run_once: true
    
    - name: Validate become method
      ansible.builtin.fail:
        msg: |
          Invalid become method: "{{ vm_become_method }}"
          Select from available options: sudo | su | pbrun | pfexec | doas | dzdo | ksu | runas | machinectl 
      when: vm_become_method not in ['sudo', 'su', 'pbrun', 'pfexec', 'doas', 'dzdo', 'ksu', 'runas', 'machinectl']
      run_once: true

  roles:
    - ../roles/deploy_vm_on_proxmox 

  tasks:
    - name: Make the hostname available to the whole playbook
      ansible.builtin.set_fact:
        fact_vm_hostname: "{{ vm_hostname }}"
    
    - name: Make the OS template available to the whole playbook
      ansible.builtin.set_fact:
        fact_vm_os_template: "{{ vm_os_template }}"
    
    - name: Make the IP available to the whole playbook
      ansible.builtin.set_fact:
        fact_vm_ip_address: "{{ vm_ip_address.split('/') | first }}"

    - name: Add the target host to the inventory
      ansible.builtin.add_host:
        name: "{{ fact_vm_ip_address }}"
        groups: new_host
        ansible_user: ansible
        ansible_become_password: "{{ ansible_become_passwd }}"
        ansible_become_method: "{{ vm_become_method }}"


- name: Configure VM
  hosts: new_host
  remote_user: ansible

  vars_files:
    ../inventory/group_vars/all/secrets.yaml
  vars:
    ansible_user_passwd_hash: "{{ ansible_password | password_hash('sha512', 's3edscrj45e6r') }}"
    user_passwd_hash: "{{ user_password | password_hash('sha512', 's3ed6123jhgcr') }}"

  roles:
    - ../roles/configure_ansible_user 
    - ../roles/harden_ssh 
    - ../roles/base_system
    - ../roles/human_admin_user
    # Update configs - omz, nvim, ranger and so on. Distribute the last version of those configs
    - ../roles/update_configs