# Базовый провижнинг: пакеты, права на HackRF, имя узла, deploy-ключ, паспорт.
# Нужен интернет на узлах (wifi-on.yml). Код на узлы кладёт deploy.yml.
- name: Провижнинг приёмников пеленгации
  hosts: all
  tasks:

    - name: Обновить кэш apt (не считается изменением)
      become: true
      ansible.builtin.apt:
        update_cache: true
        cache_valid_time: 3600
      changed_when: false
      tags: [base]

    - name: apt full-upgrade
      become: true
      ansible.builtin.apt:
        upgrade: full
      tags: [base]

    - name: Зависимости сборки, утилиты HackRF, python для node.py
      become: true
      ansible.builtin.apt:
        name: [cmake, g++, pkg-config, git, rsync, libhackrf-dev, libusb-1.0-0-dev, libfftw3-dev, hackrf, python3, fish]
        state: present
      tags: [base]

    - name: pi в группе plugdev, login-shell fish
      become: true
      ansible.builtin.user:
        name: pi
        groups: plugdev
        append: true
        shell: /usr/bin/fish
      tags: [base]

    - name: Права udev на уже подключённый HackRF (устройство старше правил)
      become: true
      ansible.builtin.shell: |
        bad=0
        for d in /sys/bus/usb/devices/*; do
          [ -f "$d/idVendor" ] || continue
          case "$(cat "$d/idVendor"):$(cat "$d/idProduct")" in 1d50:6089|1d50:604b) ;; *) continue;; esac
          node=/dev/bus/usb/$(printf %03d "$(cat "$d/busnum")")/$(printf %03d "$(cat "$d/devnum")")
          [ "$(stat -c %G "$node")" = plugdev ] || bad=1
        done
        if [ "$bad" = 1 ]; then
          udevadm control --reload-rules && udevadm trigger --subsystem-match=usb && echo FIXED
        else
          echo OK
        fi
      register: usb
      changed_when: "'FIXED' in usb.stdout"
      tags: [base]

    - name: Имя узла
      become: true
      ansible.builtin.hostname:
        name: "{{ inventory_hostname }}"
      tags: [hostname]

    - name: Имя узла в /etc/hosts
      become: true
      ansible.builtin.lineinfile:
        path: /etc/hosts
        regexp: '^127\.0\.1\.1'
        line: "127.0.1.1\t{{ inventory_hostname }}"
      tags: [hostname]

    - name: Deploy-ключ есть в keys/
      delegate_to: localhost
      run_once: true
      ansible.builtin.stat:
        path: "{{ playbook_dir }}/keys/gitea_deploy"
      register: deploy_key
      tags: [key]

    - name: Ключа нет
      run_once: true
      ansible.builtin.fail:
        msg: "[!] нет keys/gitea_deploy, запустите scripts/gen-key.sh"
      when: not deploy_key.stat.exists
      tags: [key]

    - name: ~/.ssh
      ansible.builtin.file:
        path: ~/.ssh
        state: directory
        mode: "0700"
      tags: [key]

    - name: Приватный deploy-ключ
      ansible.builtin.copy:
        src: "{{ playbook_dir }}/keys/gitea_deploy"
        dest: ~/.ssh/gitea_deploy
        mode: "0600"
      tags: [key]

    - name: ssh config для Gitea
      ansible.builtin.blockinfile:
        path: ~/.ssh/config
        create: true
        mode: "0600"
        marker: "# {mark} fleet gitea"
        block: |
          Host {{ gitea_host }}
            Port {{ gitea_port }}
            User git
            IdentityFile ~/.ssh/gitea_deploy
            IdentitiesOnly yes
            StrictHostKeyChecking accept-new
      tags: [key]

    - name: ~/node.env для node.py (только засев, полевые правки не трогаем)
      ansible.builtin.copy:
        dest: ~/node.env
        mode: "0644"
        force: false
        content: |
          SDR_ID={{ sdr_id }}
          X={{ x }}
          Y={{ y }}
          SERVER={{ server_ip }}
      tags: [env]