---
- name: Validate selected pipeline operator accounts
  ansible.builtin.getent:
    database: passwd
    key: "{{ item }}"
  loop: "{{ dnd_pipeline_operator_users }}"

- name: Enroll selected pipeline operators
  become: true
  ansible.builtin.user:
    name: "{{ item }}"
    groups: "{{ dnd_pipeline_runtime_group }}"
    append: true
    state: present
  loop: "{{ dnd_pipeline_operator_users }}"

- name: Install ACL support
  become: true
  ansible.builtin.apt:
    name: acl
    state: present
    update_cache: true
    cache_valid_time: 3600

- name: Validate managed Narratio credential entries
  ansible.builtin.assert:
    that:
      - item.key is string
      - item.key is match('^[A-Za-z_][A-Za-z0-9_]*$')
      - item.value is string
  loop: "{{ dnd_pipeline_secrets | dict2items }}"
  loop_control:
    label: "{{ item.key }}"
  no_log: true

- name: Create the Narratio secrets directory
  become: true
  ansible.builtin.file:
    path: /usr/local/etc/narratio/secrets
    state: directory
    owner: "{{ dnd_pipeline_runtime_user }}"
    group: "{{ dnd_pipeline_runtime_group }}"
    mode: "0750"

- name: Converge managed Narratio credentials
  become: true
  ansible.builtin.copy:
    content: "{{ item.value }}"
    dest: "/usr/local/etc/narratio/secrets/{{ item.key }}"
    owner: "{{ dnd_pipeline_runtime_user }}"
    group: "{{ dnd_pipeline_runtime_group }}"
    mode: "0640"
  loop: "{{ dnd_pipeline_secrets | dict2items }}"
  loop_control:
    label: "{{ item.key }}"
  no_log: true

- name: Create the Notarius cache root
  become: true
  ansible.builtin.file:
    path: "{{ dnd_pipeline_notarius_cache_root }}"
    state: directory
    owner: "{{ dnd_pipeline_runtime_user }}"
    group: "{{ dnd_pipeline_runtime_group }}"
    mode: "2775"

- name: Converge access ACLs on shared pipeline writable roots
  become: true
  ansible.posix.acl:
    path: "{{ item.0 }}"
    etype: "{{ item.1.etype }}"
    permissions: "{{ item.1.permissions }}"
    state: present
  loop: >-
    {{
      ['/var/lib/narratio', '/var/spool/narratio', '/var/cache/narratio', dnd_pipeline_notarius_cache_root] |
      product([
        {'etype': 'user', 'permissions': 'rwx'},
        {'etype': 'group', 'permissions': 'rwx'},
        {'etype': 'other', 'permissions': 'r-x'},
        {'etype': 'mask', 'permissions': 'rwx'}
      ]) | list
    }}
  loop_control:
    label: "{{ item.0 }} {{ item.1.etype }}::{{ item.1.permissions }}"

- name: Converge default ACLs on shared pipeline writable roots
  become: true
  ansible.posix.acl:
    path: "{{ item.0 }}"
    etype: "{{ item.1.etype }}"
    permissions: "{{ item.1.permissions }}"
    default: true
    state: present
  loop: >-
    {{
      ['/var/lib/narratio', '/var/spool/narratio', '/var/cache/narratio', dnd_pipeline_notarius_cache_root] |
      product([
        {'etype': 'user', 'permissions': 'rwx'},
        {'etype': 'group', 'permissions': 'rwx'},
        {'etype': 'other', 'permissions': 'r-x'},
        {'etype': 'mask', 'permissions': 'rwx'}
      ]) | list
    }}
  loop_control:
    label: "{{ item.0 }} default:{{ item.1.etype }}::{{ item.1.permissions }}"

- name: Create the prompt-library root
  become: true
  ansible.builtin.file:
    path: "{{ dnd_pipeline_prompt_library_root }}"
    state: directory
    owner: root
    group: "{{ dnd_pipeline_runtime_group }}"
    mode: "0755"

- name: Deploy the campaign registry
  become: true
  ansible.builtin.git:
    repo: "{{ dnd_pipeline_campaigns_repository_url }}"
    dest: "{{ dnd_pipeline_campaigns_root }}"
    version: "{{ dnd_pipeline_campaigns_revision }}"
    update: true
    force: true

- name: Deploy the prompt library
  become: true
  ansible.builtin.git:
    repo: "{{ dnd_pipeline_prompt_library_repository_url }}"
    dest: "{{ dnd_pipeline_prompt_library_root }}"
    version: "{{ dnd_pipeline_prompt_library_revision }}"
    update: true
    force: true

- name: Create Narratio configuration directories
  become: true
  ansible.builtin.file:
    path: "/usr/local/etc/narratio/{{ item }}"
    state: directory
    owner: "{{ dnd_pipeline_runtime_user }}"
    group: "{{ dnd_pipeline_runtime_group }}"
    mode: "{{ dnd_pipeline_config_directory_mode }}"
  loop:
    - conf.d
    - artifacts
    - artifact-families
    - overlays

- name: Create Notarius configuration directories
  become: true
  ansible.builtin.file:
    path: "/usr/local/etc/notarius/{{ item }}"
    state: directory
    owner: "{{ dnd_pipeline_runtime_user }}"
    group: "{{ dnd_pipeline_runtime_group }}"
    mode: "{{ dnd_pipeline_config_directory_mode }}"
  loop:
    - pipelines
    - overlays

- name: Create the Audita profile directory
  become: true
  ansible.builtin.file:
    path: /usr/local/etc/audita/profiles
    state: directory
    owner: "{{ dnd_pipeline_runtime_user }}"
    group: "{{ dnd_pipeline_runtime_group }}"
    mode: "{{ dnd_pipeline_config_directory_mode }}"

- name: Deploy Audita profiles
  become: true
  ansible.builtin.template:
    src: audita-profile.yml.j2
    dest: "/usr/local/etc/audita/profiles/{{ item.key }}.yml"
    owner: "{{ dnd_pipeline_runtime_user }}"
    group: "{{ dnd_pipeline_runtime_group }}"
    mode: "{{ dnd_pipeline_config_file_mode }}"
  loop: "{{ dnd_pipeline_audita_profiles | dict2items }}"

- name: Deploy the Notarius D&D pipeline configuration
  become: true
  ansible.builtin.template:
    src: dnd-session.yml.j2
    dest: /usr/local/etc/notarius/pipelines/dnd-session.yml
    owner: "{{ dnd_pipeline_runtime_user }}"
    group: "{{ dnd_pipeline_runtime_group }}"
    mode: "{{ dnd_pipeline_config_file_mode }}"

- name: Deploy the Notarius testing overlay
  become: true
  ansible.builtin.template:
    src: notarius-testing.yml.j2
    dest: /usr/local/etc/notarius/overlays/testing.yml
    owner: "{{ dnd_pipeline_runtime_user }}"
    group: "{{ dnd_pipeline_runtime_group }}"
    mode: "{{ dnd_pipeline_config_file_mode }}"

- name: Deploy Narratio D&D configuration fragments
  become: true
  ansible.builtin.template:
    src: "{{ item.src }}"
    dest: "/usr/local/etc/narratio/{{ item.dest }}"
    owner: "{{ dnd_pipeline_runtime_user }}"
    group: "{{ dnd_pipeline_runtime_group }}"
    mode: "{{ dnd_pipeline_config_file_mode }}"
  loop:
    - src: processing.yml.j2
      dest: conf.d/processing.yml
    - src: session-recap.yml.j2
      dest: artifacts/session-recap.yml
    - src: hostile-rumors.yml.j2
      dest: artifacts/hostile-rumors.yml
    - src: deranged-rumors.yml.j2
      dest: artifacts/deranged-rumors.yml
    - src: scene-map.yml.j2
      dest: artifacts/scene-map.yml
    - src: character-meta-analysis.yml.j2
      dest: artifact-families/character-meta-analysis.yml
    - src: testing.yml.j2
      dest: overlays/testing.yml