---
# ── User creation (tous les hosts) ────────────────────────────────────────────

- name: Create hermes group
  ansible.builtin.group:
    name: "{{ hermes_group }}"
    gid: "{{ hermes_gid }}"
    state: present

- name: Create hermes user
  ansible.builtin.user:
    name: "{{ hermes_user }}"
    group: "{{ hermes_group }}"
    uid: "{{ hermes_uid }}"
    home: "{{ hermes_home }}"
    shell: "{{ hermes_shell }}"
    create_home: true
    state: present

- name: Create .ssh directory for hermes
  ansible.builtin.file:
    path: "{{ hermes_home }}/.ssh"
    state: directory
    owner: "{{ hermes_user }}"
    group: "{{ hermes_group }}"
    mode: '0700'

- name: Add hermes to systemd-journal group
  ansible.builtin.user:
    name: "{{ hermes_user }}"
    groups: systemd-journal
    append: true

# ── Sudoers limité ─────────────────────────────────────────────────────────────

- name: Allow hermes limited sudo on storage-01
  ansible.builtin.copy:
    dest: /etc/sudoers.d/hermes
    content: |
      # Hermes agent — monitoring local
      hermes ALL=(ALL) NOPASSWD: /usr/sbin/smartctl *
      hermes ALL=(ALL) NOPASSWD: /usr/bin/journalctl *
    mode: '0440'
    validate: /usr/sbin/visudo -cf %s
  when: inventory_hostname in groups['gateway']

- name: Allow hermes limited sudo on gpu-01
  ansible.builtin.copy:
    dest: /etc/sudoers.d/hermes
    content: |
      # Hermes agent — GPU monitoring
      hermes ALL=(ALL) NOPASSWD: /usr/bin/rocm-smi
      hermes ALL=(ALL) NOPASSWD: /bin/systemctl status llama-server*
      hermes ALL=(ALL) NOPASSWD: /usr/bin/journalctl *
    mode: '0440'
    validate: /usr/sbin/visudo -cf %s
  when: inventory_hostname in groups['gpu_hosts']

# ── Génération clé SSH (storage-01 uniquement) ────────────────────────────────

- name: Generate SSH key for hermes
  ansible.builtin.user:
    name: "{{ hermes_user }}"
    generate_ssh_key: true
    ssh_key_type: "{{ hermes_ssh_key_type }}"
    ssh_key_file: ".ssh/id_{{ hermes_ssh_key_type }}"
    ssh_key_comment: "{{ hermes_ssh_key_comment }}"
  when: inventory_hostname in groups['gateway']

- name: Read hermes public key
  ansible.builtin.slurp:
    src: "{{ hermes_home }}/.ssh/id_{{ hermes_ssh_key_type }}.pub"
  register: hermes_pub_key
  when: inventory_hostname in groups['gateway']

# ── Distribution clé publique → gpu-01 ────────────────────────────────────────

- name: Add hermes public key to gpu-01 authorized_keys
  ansible.posix.authorized_key:
    user: "{{ hermes_user }}"
    key: "{{ hermes_pub_key.content | b64decode | trim }}"
    state: present
  delegate_to: "{{ item }}"
  loop: "{{ groups['gpu_hosts'] }}"
  when: inventory_hostname in groups['gateway']

# ── SSH config + known_hosts (storage-01) ─────────────────────────────────────

- name: Deploy SSH client config for hermes
  ansible.builtin.template:
    src: ssh_config.j2
    dest: "{{ hermes_home }}/.ssh/config"
    owner: "{{ hermes_user }}"
    group: "{{ hermes_group }}"
    mode: '0600'
  when: inventory_hostname in groups['gateway']

- name: Scan gpu-01 SSH host key
  ansible.builtin.command:
    cmd: "ssh-keyscan -t ed25519 {{ hostvars['gpu-01'].ansible_host }}"
  register: gpu01_hostkey
  changed_when: false
  when: inventory_hostname in groups['gateway']

- name: Add gpu-01 to hermes known_hosts
  ansible.builtin.known_hosts:
    name: "{{ hostvars['gpu-01'].ansible_host }}"
    key: "{{ gpu01_hostkey.stdout }}"
    path: "{{ hermes_home }}/.ssh/known_hosts"
    state: present
  when:
    - inventory_hostname in groups['gateway']
    - gpu01_hostkey.stdout | length > 0

- name: Fix ownership of hermes .ssh directory
  ansible.builtin.file:
    path: "{{ hermes_home }}/.ssh"
    state: directory
    owner: "{{ hermes_user }}"
    group: "{{ hermes_group }}"
    recurse: true
  when: inventory_hostname in groups['gateway']

# ── kubeconfig pour kubectl (storage-01) ──────────────────────────────────────

- name: Create .kube directory for hermes
  ansible.builtin.file:
    path: "{{ hermes_home }}/.kube"
    state: directory
    owner: "{{ hermes_user }}"
    group: "{{ hermes_group }}"
    mode: '0700'
  when: inventory_hostname in groups['gateway']

- name: Check if ansible kubeconfig exists
  ansible.builtin.stat:
    path: /home/ansible/.kube/config
  register: ansible_kubeconfig
  when: inventory_hostname in groups['gateway']

- name: Copy kubeconfig to hermes home
  ansible.builtin.copy:
    src: /home/ansible/.kube/config
    dest: "{{ hermes_home }}/.kube/config"
    owner: "{{ hermes_user }}"
    group: "{{ hermes_group }}"
    mode: '0600'
    remote_src: true
  when:
    - inventory_hostname in groups['gateway']
    - ansible_kubeconfig.stat.exists