---
# NOTE ARCHITECTURE (2026-05-29) :
# /srv/data est maintenant un bind-mount de /home/data (LV NVMe almalinux-home).
# Le RAID5 md0 n'est PLUS monté sur /srv/data — ne jamais remettre une entrée
# UUID=3add8360 dans fstab ni utiliser ansible.posix.mount state=mounted ici.
# fstab actuel : /home/data /srv/data none bind 0 0

- name: Install nfs-utils and mdadm
  ansible.builtin.dnf:
    name:
      - nfs-utils
      - mdadm
    state: present

# --- RAID persistence (surveillance seulement — array non monté) ---

- name: Capture mdadm array state
  ansible.builtin.shell:
    cmd: mdadm --detail --scan
  register: mdadm_scan
  changed_when: false
  failed_when: false

- name: Write /etc/mdadm.conf (si array détecté)
  ansible.builtin.copy:
    content: "{{ mdadm_scan.stdout }}\n"
    dest: /etc/mdadm.conf
    mode: '0644'
  when: mdadm_scan.stdout | length > 0
  notify: Rebuild initramfs

# --- /srv/data géré par fstab (bind-mount NVMe) ---
# La tâche "Mount RAID5 array" a été supprimée le 2026-05-29.
# /srv/data est monté via fstab au boot. On vérifie juste que le point de
# montage existe — Ansible ne touche pas au fstab ni au montage.

- name: Ensure /srv/data is a directory (sanity check)
  ansible.builtin.file:
    path: "{{ raid_mount }}"
    state: directory
    mode: '0755'

# --- Répertoires NFS ---

- name: Create NFS export directories
  ansible.builtin.file:
    path: "{{ item.path }}"
    state: directory
    mode: '0755'
    owner: nobody
    group: nobody
  loop: "{{ nfs_exports }}"

# --- NFS server ---

- name: Deploy /etc/exports
  ansible.builtin.template:
    src: exports.j2
    dest: /etc/exports
    mode: '0644'
  notify:
    - Reload exports
    - Restart nfs-server

- name: Enable and start nfs-server
  ansible.builtin.systemd:
    name: nfs-server
    enabled: true
    state: started

# --- Firewall ---

- name: Allow NFS through firewall (firewalld uniquement, pas nftables)
  ansible.posix.firewalld:
    service: "{{ item }}"
    permanent: true
    state: enabled
    immediate: true
  loop:
    - nfs
    - mountd
    - rpc-bind
  when: ansible_facts.services['firewalld.service'] is defined
        and ansible_facts.services['firewalld.service']['state'] == 'running'