---
- name: Require completed Atlas SFTP mount configuration
  tags: [services, rclone, navidrome]
  ansible.builtin.assert:
    that:
      - server_atlas_sftp_host != 'CHANGEME_ATLAS_WIREGUARD_IP'
      - server_atlas_sftp_known_host != 'CHANGEME_ATLAS_SSH_HOST_KEY'
      - server_atlas_sftp_known_host | length > 0
      - server_atlas_sftp_private_key | length > 0
      - server_atlas_sftp_remote_path == '/pool/media/music'
    fail_msg: >-
      Define the Atlas WireGuard address, pinned SSH host key and Vault-backed
      SFTP private key before enabling the music mount.
  no_log: true
  when: server_atlas_music_enabled | bool

- name: Create private rclone configuration directory
  tags: [services, rclone, navidrome]
  ansible.builtin.file:
    path: "{{ server_rclone_config_dir }}"
    state: directory
    owner: root
    group: "{{ server_user_group }}"
    mode: "0750"
  when: server_atlas_music_enabled | bool

- name: Install Vault-backed Atlas SFTP private key
  tags: [services, rclone, navidrome]
  ansible.builtin.copy:
    content: "{{ server_atlas_sftp_private_key | trim }}\n"
    dest: "{{ server_atlas_sftp_private_key_file }}"
    owner: "{{ server_username }}"
    group: "{{ server_user_group }}"
    mode: "0600"
  no_log: true
  diff: false
  notify:
    - Restart rclone music mount
    - Restart rootless Navidrome
  when: server_atlas_music_enabled | bool

- name: Install pinned Atlas SSH host key
  tags: [services, rclone, navidrome]
  ansible.builtin.copy:
    content: "{{ server_atlas_sftp_known_host | trim }}\n"
    dest: "{{ server_atlas_sftp_known_hosts_file }}"
    owner: "{{ server_username }}"
    group: "{{ server_user_group }}"
    mode: "0640"
  notify:
    - Restart rclone music mount
    - Restart rootless Navidrome
  when: server_atlas_music_enabled | bool

- name: Render Atlas SFTP rclone configuration
  tags: [services, rclone, navidrome]
  ansible.builtin.template:
    src: rclone.conf.j2
    dest: "{{ server_rclone_config_file }}"
    owner: "{{ server_username }}"
    group: "{{ server_user_group }}"
    mode: "0600"
  notify:
    - Restart rclone music mount
    - Restart rootless Navidrome
  when: server_atlas_music_enabled | bool

- name: Create rclone music directories
  tags: [services, rclone, navidrome]
  ansible.builtin.file:
    path: "{{ item }}"
    state: directory
    owner: "{{ server_username }}"
    group: "{{ server_user_group }}"
    mode: "0750"
  loop:
    - "{{ server_rclone_music_mountpoint }}"
    - "{{ server_rclone_music_cache_dir }}"
  loop_control:
    label: "{{ item }}"
  when: server_atlas_music_enabled | bool

- name: Render rclone music system service
  tags: [services, rclone, navidrome]
  ansible.builtin.template:
    src: rclone-music.service.j2
    dest: "/etc/systemd/system/{{ server_rclone_music_service }}"
    owner: root
    group: root
    mode: "0644"
  notify:
    - Restart rclone music mount
    - Restart rootless Navidrome
  when: server_atlas_music_enabled | bool

- name: Enable and start rclone music mount
  tags: [services, rclone, navidrome]
  ansible.builtin.systemd:
    name: "{{ server_rclone_music_service }}"
    enabled: true
    state: started
    daemon_reload: true
  when:
    - server_atlas_music_enabled | bool
    - not ansible_check_mode