---
# raspberrypi/tasks/main.yml
# Post-IPA-enrollment setup for the Raspberry Pi edge node.
# Mirrors debian-configuration/raspberrypi/scripts/.

# ── IPA sudo ──────────────────────────────────────────────────────────────────

- name: Check IPA enrollment
  ansible.builtin.stat:
    path: /etc/ipa/default.conf
  register: ipa_conf
  tags: ipa

- name: Write IPA admins sudoers file
  ansible.builtin.copy:
    content: "%admins ALL=(ALL) NOPASSWD:ALL\n"
    dest: /etc/sudoers.d/ipa-admins
    mode: "0440"
    validate: "visudo -cf %s"
  when:
    - raspberrypi_setup_ipa_sudo
    - ipa_conf.stat.exists
  tags: ipa

# ── Docker GID pinning ────────────────────────────────────────────────────────

- name: Check docker group GID
  ansible.builtin.command:
    cmd: "getent group docker"
  register: docker_group
  changed_when: false
  failed_when: false
  when: raspberrypi_pin_docker_gid
  tags: docker

- name: Pin docker group GID to IPA docker-access GID
  block:
    - name: Stop docker service and socket
      ansible.builtin.systemd:
        name: "{{ item }}"
        state: stopped
      loop:
        - docker.service
        - docker.socket

    - name: Remove stale docker socket
      ansible.builtin.file:
        path: /var/run/docker.sock
        state: absent

    - name: Reassign docker group GID (non-unique — SSSD already owns this GID)
      ansible.builtin.command:
        cmd: "groupmod --non-unique -g {{ docker_access_gid }} docker"
      changed_when: true

    - name: Start docker socket and service
      ansible.builtin.systemd:
        name: "{{ item }}"
        state: started
      loop:
        - docker.socket
        - docker.service

    - name: Verify socket GID
      ansible.builtin.command:
        cmd: "stat -c '%g' /var/run/docker.sock"
      register: socket_gid
      changed_when: false
      failed_when: socket_gid.stdout != docker_access_gid | string
  when:
    - raspberrypi_pin_docker_gid
    - docker_group.rc == 0
    - docker_group.stdout.split(':')[2] != docker_access_gid | string
  tags: docker