---
# --- Dépendances système ---

- name: Install Hermes Agent dependencies
  ansible.builtin.dnf:
    name:
      - curl
      - git
      - tar
    state: present

# --- Utilisateur système ---

- name: Create hermes system user
  ansible.builtin.user:
    name: "{{ hermes_user }}"
    home: "{{ hermes_home }}"
    shell: /bin/bash
    system: false
    create_home: true
    state: present

# --- Environnement shell utilisateur ---

- name: Set HERMES_HOME in hermes user bashrc
  ansible.builtin.lineinfile:
    path: "{{ hermes_home }}/.bashrc"
    line: "export HERMES_HOME={{ hermes_data_dir }}"
    create: true
    owner: "{{ hermes_user }}"
    group: "{{ hermes_user }}"
    mode: '0644'

- name: Add hermes venv to PATH in bashrc
  ansible.builtin.lineinfile:
    path: "{{ hermes_home }}/.bashrc"
    line: "export PATH={{ hermes_data_dir }}/hermes-agent/venv/bin:$PATH"
    create: true
    owner: "{{ hermes_user }}"
    group: "{{ hermes_user }}"
    mode: '0644'

# --- Répertoire données (RAID5) ---

- name: Create HERMES_HOME on RAID5
  ansible.builtin.file:
    path: "{{ hermes_data_dir }}"
    state: directory
    owner: "{{ hermes_user }}"
    group: "{{ hermes_user }}"
    mode: '0750'

# --- Installation ---

- name: Check if hermes binary is already installed
  ansible.builtin.stat:
    path: "{{ hermes_home }}/.local/bin/hermes"
  register: hermes_binary

- name: Install Hermes Agent via installer script
  ansible.builtin.shell:
    cmd: curl -fsSL https://hermes-agent.nousresearch.com/install.sh | bash
    executable: /bin/bash
  become: true
  become_user: "{{ hermes_user }}"
  environment:
    HOME: "{{ hermes_home }}"
    HERMES_HOME: "{{ hermes_data_dir }}"
  when: not hermes_binary.stat.exists
  register: hermes_install_result

- name: Show installer output
  ansible.builtin.debug:
    var: hermes_install_result.stdout_lines
  when: hermes_install_result is changed

# --- Packages Python pour les skills ---

- name: Install Python packages for Hermes skills
  ansible.builtin.pip:
    name: "qdrant-client>=1.12.0"
    executable: "{{ hermes_data_dir }}/hermes-agent/venv/bin/pip"
    state: present
  become: true
  become_user: "{{ hermes_user }}"
  when: hermes_binary.stat.exists

# --- Configuration ---

- name: Ensure LM_BASE_URL in .env points to LiteLLM
  ansible.builtin.lineinfile:
    path: "{{ hermes_data_dir }}/.env"
    regexp: '^LM_BASE_URL='
    line: "LM_BASE_URL={{ hermes_lm_base_url }}"
    create: false
  notify: Restart hermes-agent
  when: hermes_binary.stat.exists

- name: Ensure LM_API_KEY in .env is correct
  ansible.builtin.lineinfile:
    path: "{{ hermes_data_dir }}/.env"
    regexp: '^LM_API_KEY='
    line: "LM_API_KEY={{ hermes_lm_api_key }}"
    create: false
  notify: Restart hermes-agent
  when: hermes_binary.stat.exists

- name: Deploy Hermes config.yaml
  ansible.builtin.template:
    src: config.yaml.j2
    dest: "{{ hermes_data_dir }}/config.yaml"
    owner: "{{ hermes_user }}"
    group: "{{ hermes_user }}"
    mode: '0640'
  notify: Restart hermes-agent

# --- Service systemd ---

- name: Deploy hermes-agent systemd service
  ansible.builtin.template:
    src: hermes-agent.service.j2
    dest: /etc/systemd/system/hermes-agent.service
    mode: '0644'
  notify:
    - Reload systemd
    - Restart hermes-agent

- name: Enable and start hermes-agent
  ansible.builtin.systemd:
    name: hermes-agent
    enabled: true
    daemon_reload: true
    state: started

# --- Wrapper global ---

- name: Deploy hermes global wrapper (/usr/local/bin/hermes)
  ansible.builtin.copy:
    dest: /usr/local/bin/hermes
    mode: '0755'
    content: |
      #!/bin/bash
      exec sudo -u {{ hermes_user }} \
        HOME={{ hermes_home }} \
        HERMES_HOME={{ hermes_data_dir }} \
        {{ hermes_data_dir }}/hermes-agent/venv/bin/hermes "$@"

# --- Firewall ---

- name: Open Hermes gateway port in firewall
  ansible.posix.firewalld:
    port: "{{ hermes_gateway_port }}/tcp"
    permanent: true
    state: enabled
    immediate: true
  when: ansible_facts.services['firewalld.service'] is defined
        and ansible_facts.services['firewalld.service']['state'] == 'running'