---
# hermes_exec — déploie l'exécuteur d'actions Hermes (storage-01).

- name: Garde-fou — jeton hermes_exec obligatoire
  ansible.builtin.assert:
    that:
      - hermes_exec_token | length > 0
    fail_msg: >-
      vault_hermes_exec_token est vide. Ajoute-le dans group_vars/all/vault.yml
      (make vault-edit) avant de déployer hermes_exec.

- name: Installer le serveur hermes-exec
  ansible.builtin.copy:
    src: "{{ inventory_dir }}/../tools/hermes-exec/server.py"
    dest: /usr/local/bin/hermes-exec-server
    owner: root
    group: root
    mode: "0755"
  notify: restart hermes-exec

- name: Créer le fichier de log (accessible au user hermes)
  ansible.builtin.file:
    path: "{{ hermes_exec_log }}"
    state: touch
    owner: "{{ hermes_exec_user }}"
    group: "{{ hermes_exec_group }}"
    mode: "0640"
    modification_time: preserve
    access_time: preserve

- name: Répertoire du fichier d'environnement (jeton)
  ansible.builtin.file:
    path: /etc/hermes-exec
    state: directory
    owner: root
    group: "{{ hermes_exec_group }}"
    mode: "0750"

- name: Déposer le jeton (EnvironmentFile à accès restreint)
  ansible.builtin.template:
    src: hermes-exec.env.j2
    dest: /etc/hermes-exec/env
    owner: root
    group: "{{ hermes_exec_group }}"
    mode: "0640"
  no_log: true
  notify: restart hermes-exec

- name: Unité systemd hermes-exec
  ansible.builtin.template:
    src: hermes-exec.service.j2
    dest: /etc/systemd/system/hermes-exec.service
    owner: root
    group: root
    mode: "0644"
  notify:
    - reload systemd
    - restart hermes-exec

- name: Activer et démarrer hermes-exec
  ansible.builtin.systemd:
    name: hermes-exec
    enabled: true
    state: started
    daemon_reload: true