---
# -----------------------------
# Play 1: Check remote env files
# -----------------------------
- name: Check if GoDaddy env file exists on remote hosts
  hosts: acme_hosts
  gather_facts: false
  tasks:
    - name: Stat godaddy.env
      stat:
        path: "{{ acme_home }}/godaddy.env"
      register: gd_env_stat
  tags: acme

# -----------------------------
# Play 2: Fetch secrets from 1Password (control node)
# Only runs if any remote host is missing the env file
# -----------------------------
- name: Fetch GoDaddy API credentials from 1Password if needed
  hosts: acme_hosts
  # connection: local
  # delegate_to: localhost
  run_once: true
  gather_facts: false
  vars:
    op_account: my.1password.com
    op_item_title: godaddy-api
  tasks:
    - name: Determine if fetch is needed
      run_once: true
      delegate_to: localhost
      set_fact:
        fetch_godaddy_creds: >-
          {{
            groups['acme_hosts']
            | map('extract', hostvars)
            | selectattr('gd_env_stat.stat.exists','equalto',false)
            | list
            | length > 0
          }}

    - name: Get GD_Key and GD_Secret from 1Password
      run_once: true
      delegate_to: localhost
      command: op item get "{{ op_item_title }}" --account {{ op_account }} --fields username,credential --reveal
      register: godaddy_creds_raw
      changed_when: false
      when: fetch_godaddy_creds

    - name: Split GD_Key and GD_Secret
      run_once: true
      # delegate_to: localhost
      set_fact:
        gd_key: "{{ godaddy_creds_raw.stdout.split(',')[0] }}"
        gd_secret: "{{ godaddy_creds_raw.stdout.split(',')[1] }}"
      when: fetch_godaddy_creds

    - name: Add GD_Key and GD_Secret to hostvars for remote hosts
      run_once: true
      # delegate_to: localhost
      add_host:
        name: "{{ item }}"
        gd_key: "{{ gd_key }}"
        gd_secret: "{{ gd_secret }}"
      loop: "{{ groups['all'] }}"
      when: fetch_godaddy_creds
  tags: acme

# -----------------------------
# Play 2: Run role on remote hosts
# -----------------------------
- name: ACME + Apache TLS bootstrap
  hosts: all
  become: true
  roles:
    - apache

- name: ACME
  hosts: all
  become: true
  roles:
    - acme
  tags: acme

- name: plex
  hosts: all
  become: true
  roles:
    - plex
  tags: plex