---

- name: Deploy Gitea Action
  hosts: raspberries:&local:!gitea # do not deploy on machine with gitea instance

  roles:
    - arcodange.factory.gitea_token # generate gitea_api_token used to replace generated token with set name if required

  tasks:

    - name: Fetch Gitea Token for Action Runner registration
      delegate_to: "{{ groups.gitea[0] }}"
      delegate_facts: false
      ansible.builtin.command:
        docker exec gitea su git -c "gitea actions generate-runner-token"
      register: gitea_runner_token_cmd

    - name: Deploy Gitea Action Docker Compose configuration
      include_role:
        name: arcodange.factory.deploy_docker_compose
      vars:
        dockercompose_content:
          name: arcodange_factory_gitea_action
          services:
            gitea_action:
              image: gitea/act_runner:latest
              container_name: gitea_action
              restart: always
              environment:
                CONFIG_FILE: /config.yaml
                GITEA_INSTANCE_URL: >-
                  http://{{ hostvars[groups.gitea[0]].ansible_host }}:3000
                GITEA_RUNNER_REGISTRATION_TOKEN: "{{ gitea_runner_token_cmd.stdout }}"
                GITEA_RUNNER_NAME: arcodange_global_runner_{{ inventory_hostname }}
                GITEA_RUNNER_LABELS: ubuntu-latest:docker://gitea.arcodange.lab/arcodange-org/runner-images:ubuntu-latest-ca,ubuntu-latest-ca:docker://gitea.arcodange.lab/arcodange-org/runner-images:ubuntu-latest-ca
              volumes:
                - /var/run/docker.sock:/var/run/docker.sock
                - /etc/timezone:/etc/timezone:ro
                - /etc/localtime:/etc/localtime:ro
                - /etc/ssl/certs:/etc/ssl/certs:ro
                - /usr/local/share/ca-certificates/:/usr/local/share/ca-certificates/:ro
              configs:
                - config.yaml
          configs:
            config.yaml:
              content: |
                # You don't have to copy this file to your instance,
                # just run `./act_runner generate-config > config.yaml` to generate a config file.

                #log:
                #  # The level of logging, can be trace, debug, info, warn, error, fatal
                #  level: info

                runner:
                  # Where to store the registration result.
                  file: .runner
                  # Execute how many tasks concurrently at the same time.
                  capacity: 2
                  # Extra environment variables to run jobs.
                  envs:
                    A_TEST_ENV_NAME_1: a_test_env_value_1
                    A_TEST_ENV_NAME_2: a_test_env_value_2
                  # Extra environment variables to run jobs from a file.
                  # It will be ignored if it's empty or the file doesn't exist.
                  env_file: .env
                  # The timeout for a job to be finished.
                  # Please note that the Gitea instance also has a timeout (3h by default) for the job.
                  # So the job could be stopped by the Gitea instance if it's timeout is shorter than this.
                  timeout: 3h
                  # Whether skip verifying the TLS certificate of the Gitea instance.
                  insecure: true
                  # The timeout for fetching the job from the Gitea instance.
                  fetch_timeout: 5s
                  # The interval for fetching the job from the Gitea instance.
                  fetch_interval: 2s
                  # The labels of a runner are used to determine which jobs the runner can run, and how to run them.
                  # Like: "macos-arm64:host" or "ubuntu-latest:docker://gitea/runner-images:ubuntu-latest"
                  # Find more images provided by Gitea at https://gitea.com/gitea/runner-images .
                  # If it's empty when registering, it will ask for inputting labels.
                  # If it's empty when execute `daemon`, will use labels in `.runner` file.
                  labels:
                    - "ubuntu-latest:docker://gitea.arcodange.lab/arcodange-org/runner-images:ubuntu-latest-ca"
                    - "ubuntu-latest-ca:docker://gitea.arcodange.lab/arcodange-org/runner-images:ubuntu-latest-ca"

                cache:
                  # Enable cache server to use actions/cache.
                  enabled: true
                  # The directory to store the cache data.
                  # If it's empty, the cache data will be stored in $HOME/.cache/actcache.
                  dir: ""
                  # The host of the cache server.
                  # It's not for the address to listen, but the address to connect from job containers.
                  # So 0.0.0.0 is a bad choice, leave it empty to detect automatically.
                  host: "{{ ansible_default_ipv4.address }}"
                  # The port of the cache server.
                  # 0 means to use a random available port.
                  port: 0
                  # The external cache server URL. Valid only when enable is true.
                  # If it's specified, act_runner will use this URL as the ACTIONS_CACHE_URL rather than start a server by itself.
                  # The URL should generally end with "/".
                  external_server: ""

                container:
                  # Specifies the network to which the container will connect.
                  # Could be host, bridge or the name of a custom network.
                  # If it's empty, act_runner will create a network automatically.
                  network: ""
                  # Whether to use privileged mode or not when launching task containers (privileged mode is required for Docker-in-Docker).
                  privileged: false
                  # And other options to be used when the container is started (eg, --add-host=my.gitea.url:host-gateway).
                  options:
                  # The parent directory of a job's working directory.
                  # NOTE: There is no need to add the first '/' of the path as act_runner will add it automatically. 
                  # If the path starts with '/', the '/' will be trimmed.
                  # For example, if the parent directory is /path/to/my/dir, workdir_parent should be path/to/my/dir
                  # If it's empty, /workspace will be used.
                  workdir_parent:
                  # Volumes (including bind mounts) can be mounted to containers. Glob syntax is supported, see https://github.com/gobwas/glob
                  # You can specify multiple volumes. If the sequence is empty, no volumes can be mounted.
                  # For example, if you only allow containers to mount the `data` volume and all the json files in `/src`, you should change the config to:
                  # valid_volumes:
                  #   - data
                  #   - /src/*.json
                  # If you want to allow any volume, please use the following configuration:
                  # valid_volumes:
                  #   - '**'
                  valid_volumes: []
                  # overrides the docker client host with the specified one.
                  # If it's empty, act_runner will find an available docker host automatically.
                  # If it's "-", act_runner will find an available docker host automatically, but the docker host won't be mounted to the job containers and service containers.
                  # If it's not empty or "-", the specified docker host will be used. An error will be returned if it doesn't work.
                  docker_host: ""
                  # Pull docker image(s) even if already present
                  force_pull: true
                  # Rebuild docker image(s) even if already present
                  force_rebuild: false

                host:
                  # The parent directory of a job's working directory.
                  # If it's empty, $HOME/.cache/act/ will be used.
                  workdir_parent:
    - name: Deploy Gitea Action with Docker Compose
      community.docker.docker_compose_v2:
        project_src: "/home/pi/arcodange/docker_composes/arcodange_factory_gitea_action"
        pull: missing
        state: "{{ docker_compose_down_then_up }}"
      register: deploy_result
      loop: ["absent", "present"]
      loop_control:
        loop_var: docker_compose_down_then_up
    
#     - name: Set PACKAGES_TOKEN secret to upload packages from CI
#       run_once: True
#       block:
#         - name: Generate cicd PACKAGES_TOKEN
#           include_role:
#             name: arcodange.factory.gitea_token
#           vars:
#             gitea_token_name: PACKAGES_TOKEN
#             gitea_token_fact_name: cicd_PACKAGES_TOKEN
#             gitea_token_scopes: write:package
#             gitea_token_replace: true

#         - name: Register cicd PACKAGES_TOKEN secrets
#           include_role:
#             name: arcodange.factory.gitea_secret
#           vars:
#             gitea_secret_name: PACKAGES_TOKEN
#             gitea_secret_value: "{{ cicd_PACKAGES_TOKEN }}"
#           loop: ["organization", "user"]
#           loop_control:
#             loop_var: gitea_owner_type # Peut être "user" ou "organization"
    
#     - name: Set HOMELAB_CA_CERT secret to validate self signed ssl
#       run_once: True
#       block:
#         - name: Download homelab CA certificate
#           ansible.builtin.uri:
#             url: "https://ssl-ca.arcodange.lab:8443/roots.pem"
#             return_content: yes
#             validate_certs: no
#           register: homelab_ca_cert
#         - name: Debug cert
#           debug:
#             msg: "{{ homelab_ca_cert.content }}..."
#         - name: Register cicd HOMELAB_CA_CERT secrets
#           include_role:
#             name: arcodange.factory.gitea_secret
#           vars:
#             gitea_secret_name: HOMELAB_CA_CERT
#             gitea_secret_value: "{{ homelab_ca_cert.content | b64encode }}"
#           loop: ["organization", "user"]
#           loop_control:
#             loop_var: gitea_owner_type # Peut être "user" ou "organization"
  
#   post_tasks:
#     - include_role:
#         name: arcodange.factory.gitea_token
#       vars:
#         gitea_token_delete: true


# - name: Deploy Argo CD
#   hosts: localhost
#   roles:
#     - role: arcodange.factory.gitea_token # generate gitea_api_token used to replace generated token with set name if required
#       tags:
#         - gitea_sync
#   tasks:
#     - name: Set factory repo
#       include_role:
#         name: arcodange.factory.gitea_repo
#       vars:
#         gitea_repo_name: factory
#     - name: Sync other repos
#       tags: gitea_sync
#       include_role:
#         name: arcodange.factory.gitea_sync
#         apply:
#           tags: gitea_sync
#     - name: Generate Argo CD token
#       include_role:
#         name: arcodange.factory.gitea_token
#       vars:
#         gitea_token_name: ARGOCD_TOKEN
#         gitea_token_fact_name: argocd_token
#         gitea_token_scopes: read:repository,read:package
#         gitea_token_replace: true
#     - name: Figure out k3s master node
#       shell:
#         kubectl get nodes -l node-role.kubernetes.io/control-plane=true -o name | sed s'#node/##'
#       register: get_k3s_master_node
#       changed_when: false
#     - name: Get kubernetes server internal url
#       command: >-
#         echo https://kubernetes.default.svc
#         # {%raw%}
#         # kubectl get svc/kubernetes -o template="{{.spec.clusterIP}}:{{(index .spec.ports 0).port}}"
#         # {%endraw%}
#       register: get_k3s_internal_server_url
#       changed_when: false
#     - set_fact:
#         k3s_master_node: "{{ get_k3s_master_node.stdout }}"
#         k3s_internal_server_url: "{{ get_k3s_internal_server_url.stdout }}"
#     - name: Read Step CA root certificate from k3s master
#       become: true
#       delegate_to: "{{ k3s_master_node }}"
#       slurp:
#         src: /home/step/.step/certs/root_ca.crt
#       register: step_ca_root_cert
#     - name: Decode Step CA root certificate
#       set_fact:
#         step_ca_root_cert_pem: "{{ step_ca_root_cert.content | b64decode }}"
#     - name: Install Argo CD
#       become: true
#       delegate_to: "{{ k3s_master_node }}"
#       vars:
#         gitea_credentials:
#           username: arcodange
#           password: "{{ argocd_token }}"
#         argocd_helm_values: # https://github.com/argoproj/argo-helm/blob/main/charts/argo-cd/values.yaml
#           global:
#             domain: argocd.arcodange.lab
#           configs:
#             cm:
#               kustomize.buildOptions: "--enable-helm"
#               helm.enablePostRenderer: "true"
#               exec.enabled: "true"
#             params:
#               server.insecure: true # let k3s traefik do TLS termination
#       ansible.builtin.copy:
#         dest: /var/lib/rancher/k3s/server/manifests/argocd.yaml
#         content: |-
#           apiVersion: v1
#           kind: Namespace
#           metadata:
#             name: argocd
#           ---
#           apiVersion: v1
#           kind: ConfigMap
#           metadata:
#             name: argocd-tls-certs-cm
#             namespace: argocd
#           data:
#             gitea.arcodange.lab: |
#               {{ step_ca_root_cert_pem | indent(4) }}
#           ---
#           apiVersion: helm.cattle.io/v1
#           kind: HelmChart
#           metadata:
#             name: argocd
#             namespace: kube-system
#           spec:
#             repo: https://argoproj.github.io/argo-helm
#             chart: argo-cd
#             targetNamespace: argocd
#             valuesContent: |-
#               {{ argocd_helm_values | to_nice_yaml | indent( width=4 ) }}  
#           ---
#           apiVersion: networking.k8s.io/v1
#           kind: Ingress
#           metadata:
#             name: argocd-server-ingress
#             namespace: argocd
#             annotations:
#               # For Traefik v2.x
#               traefik.ingress.kubernetes.io/router.entrypoints: websecure
#               traefik.ingress.kubernetes.io/router.tls: "true"
#               traefik.ingress.kubernetes.io/router.tls.certresolver: letsencrypt
#               traefik.ingress.kubernetes.io/router.tls.domains.0.main: arcodange.lab
#               traefik.ingress.kubernetes.io/router.tls.domains.0.sans: argocd.arcodange.lab
#               traefik.ingress.kubernetes.io/router.middlewares: localIp@file
#           spec:
#             rules:
#             - host: argocd.arcodange.lab
#               http:
#                 paths:
#                 - path: /
#                   pathType: Prefix
#                   backend:
#                     service:
#                       name: argocd-server
#                       port:
#                         number: 80 #TLS is terminated at Traefik
#           ---
#           apiVersion: v1
#           kind: Secret
#           metadata:
#             name: gitea-arcodangeorg-factory-repo
#             namespace: argocd
#             labels:
#               argocd.argoproj.io/secret-type: repository
#           stringData:
#             type: git
#             url: https://gitea.arcodange.lab/arcodange-org/factory
#           ---
#           apiVersion: v1
#           kind: Secret
#           metadata:
#             name: gitea-arcodangeorg-repo-creds
#             namespace: argocd
#             labels:
#               argocd.argoproj.io/secret-type: repo-creds
#           stringData:
#             type: git
#             url: https://gitea.arcodange.lab/arcodange-org
#             password: {{ gitea_credentials.password }}
#             username: {{ gitea_credentials.username }}
#           ---
#           apiVersion: argoproj.io/v1alpha1
#           kind: Application
#           metadata:
#             name: factory
#             namespace: argocd
#           spec:
#             project: default
#             source:
#               repoURL: https://gitea.arcodange.lab/arcodange-org/factory
#               targetRevision: HEAD
#               path: argocd
#             destination:
#               server: {{ k3s_internal_server_url }}
#               namespace: argocd
#             syncPolicy:
#               automated:
#                 prune: true
#                 selfHeal: true
#     - name: touch manifests/argocd.yaml to trigger update
#       delegate_to: "{{ k3s_master_node }}"
#       ansible.builtin.file:
#         path: /var/lib/rancher/k3s/server/manifests/argocd.yaml
#         state: touch
#       become: true
#   post_tasks:
#     - include_role:
#         name: arcodange.factory.gitea_token
#         apply:
#           tags: gitea_sync
#       tags:
#         - gitea_sync
#       vars:
#         gitea_token_delete: true