---
# NOT USED AT RUNTIME. Left in place only as a reference example of the
# bundled roles' pre-`body` invocation shape (per-stepType --tags selection).
# src/server-setup/server-setup-runner.ts's generatePlaybook() now builds and
# writes a playbook dynamically (tmpDir/generated-playbook.yml, invoked
# without --tags) around the tenant admin's `body` tasks; this static file is
# never read by that code path (grep confirms no reference to
# "ansible/playbook.yml" anywhere in src/ or __tests__/). It is also stale in
# one more way: it still sets `gather_facts: true` under `become: true`,
# which is exactly the bug fixed in server-setup-runner.ts's generatePlaybook()
# (a target host without NOPASSWD sudo fails with the opaque
# "ansible.legacy.setup ... interactive authentication is required" instead
# of a clear precheck message) — do not copy this file's structure.
#
# Server setup playbook bundled with the agent CLI (agent/ansible/playbook.yml).
#
# The inventory is JSON content written with a .yml extension (JSON is valid
# YAML, so ansible-core's bundled `yaml` inventory plugin — matched by file
# extension — parses it unambiguously); see server-setup-runner.ts's
# buildInventory() for why.
#
# Each role below corresponds 1:1 to a ServerSetupStepType (os_init / docker /
# web_server / database / dns_tls). `--tags` selects which roles run; task
# names inside each role are prefixed "<stepType> : ..." so the runner can
# group the `ansible-playbook --stdout-callback=json` output (produced by
# the bundled `callback_plugins/json.py` — ansible-core does not ship a
# `json` stdout callback of its own) back into one result per requested step.
#
# See admin-docs docs/features/server-setup.md for the full design,
# especially "秘密鍵の受け渡し設計" (this playbook never touches the SSH key
# file directly — it is only referenced via the inventory's
# ansible_ssh_private_key_file).
#
# Supported OS: MVP scope is Ubuntu 22.04/24.04/26.04 LTS only (see precheck
# task below, tagged `always` so it runs regardless of which --tags are
# passed). Fixed allowlist, not a general ">= 22.04" rule.
- name: AI Support Agent server setup
  hosts: all
  become: true
  gather_facts: true

  tasks:
    - name: "precheck : Verify supported OS"
      ansible.builtin.fail:
        msg: >-
          Unsupported OS: {{ ansible_distribution }} {{ ansible_distribution_version }}.
          Only Ubuntu 22.04/24.04/26.04 LTS are supported by server setup execution.
      when: >-
        ansible_distribution != 'Ubuntu' or
        ansible_distribution_version not in ['22.04', '24.04', '26.04']
      tags: always

    # Bundled roles switch to an unprivileged `become_user` (nvm/claude_cli/
    # codex/ai_support_agent use appuser, database uses postgres). Ansible's
    # become-to-unprivileged temp-file handoff needs `setfacl` (from the `acl`
    # package), which a fresh Ubuntu host lacks — without it the first such task
    # fails with "Failed to set permissions on the temporary files Ansible needs
    # to create when becoming an unprivileged user ... chmod: invalid operator
    # ... found A". Install `acl` (as root) before any role runs.
    # generatePlaybook() in server-setup-runner.ts emits the equivalent task.
    - name: "precheck : Ensure acl (setfacl) is installed"
      ansible.builtin.apt:
        name: acl
        state: present
        update_cache: true
        cache_valid_time: 3600
      tags: always

  roles:
    - role: os_init
      tags: os_init
    - role: docker
      tags: docker
    - role: web_server
      tags: web_server
    - role: database
      tags: database
    - role: dns_tls
      tags: dns_tls