---

# FIX: InfluxData GPG Key Rotation (Required for Debian Trixie/sqv)
- name: InfluxData GPG Key Repair
  become: true
  tags: [maintenance, setup]
  block:
    - name: Remove known bad/expired Influx list files
      ansible.builtin.file:
        path: "/etc/apt/sources.list.d/{{ item }}"
        state: absent
      loop:
        - repos_influxdata_com_debian.list
        - influxdb.list

    - name: Download the 2026-valid InfluxData archive key
      ansible.builtin.get_url:
        url: https://repos.influxdata.com/influxdata-archive.key
        dest: /tmp/influxdata-archive.key
        mode: '0644'

    - name: Dearmor key for sqv (Sequoia-PGP) compatibility
      ansible.builtin.shell: |
        cat /tmp/influxdata-archive.key | gpg --dearmor > /usr/share/keyrings/influxdata-archive.gpg
      args:
        creates: /usr/share/keyrings/influxdata-archive.gpg

    - name: Write clean InfluxData source list with signed-by flag
      ansible.builtin.copy:
        dest: /etc/apt/sources.list.d/influxdata.list
        content: "deb [signed-by=/usr/share/keyrings/influxdata-archive.gpg] https://repos.influxdata.com/debian stable main"
        mode: '0644'


- name: Ensure Proxmox GPG key is present (for Raspberry Pi/PBS)
  ansible.builtin.get_url:
    url: https://enterprise.proxmox.com/debian/proxmox-release-trixie.gpg
    dest: /etc/apt/trusted.gpg.d/proxmox-release-trixie.gpg
    mode: '0644'
  become: yes
  when: ansible_distribution == 'Debian'
  tags: [setup]

- name: Set hostname
  ansible.builtin.hostname:
    name: "{{ inventory_hostname }}"
  become: yes
  tags: [identity]

- name: Update /etc/hosts for FQDN resolution
  ansible.builtin.lineinfile:
    path: /etc/hosts
    regexp: '^127\.0\.1\.1'
    line: "127.0.1.1 {{ inventory_hostname }}.{{ domain_name }} {{ inventory_hostname }}"
  become: yes
  tags: [identity]

- name: Check for NetworkManager
  ansible.builtin.command: systemctl is-active NetworkManager
  register: nm_status
  failed_when: false
  changed_when: false
  tags: [identity, network]

- name: Configure NetworkManager Search Domain (Raspberry Pi/mDNS Style)
  when: nm_status.rc == 0
  tags: [identity, network]
  block:
    - name: Get active connection name
      ansible.builtin.shell: "nmcli -t -f NAME connection show --active | head -n 1"
      register: active_conn
      changed_when: false

    - name: Apply search domain via nmcli
      ansible.builtin.command: "nmcli connection modify '{{ active_conn.stdout }}' ipv4.dns-search '{{ domain_name }}'"
      when: active_conn.stdout != ""
      notify: Reload NetworkManager

- name: Configure systemd-resolved Search Domain (Vanilla Debian Style)
  ansible.builtin.ini_file:
    path: /etc/systemd/resolved.conf
    section: Resolve
    option: Domains
    value: "{{ domain_name }}"
  become: yes
  notify: Restart systemd-resolved
  when: nm_status.rc != 0
  tags: [identity, network]

- name: Ensure the terminal is always functional
  ansible.builtin.lineinfile:
    path: /etc/profile
    line: 'export TERM=xterm-256color'
    state: present
  become: yes

- name: Set system timezone
  community.general.timezone:
    name: Europe/Berlin
  become: yes
  tags: [localization]

- name: Generate required locales
  ansible.builtin.locale_gen:
    name: "{{ item }}"
    state: present
  become: yes
  loop:
    - en_US.UTF-8
    - en_DK.UTF-8  # Required for the 24h clock format
  tags: [localization]

- name: Force system-wide locale and 24h clock
  ansible.builtin.command: update-locale LANG=en_US.UTF-8 LC_TIME=en_DK.UTF-8
  become: yes
  changed_when: true
  tags: [localization]

- name: Flush handlers to apply DNS changes immediately
  ansible.builtin.meta: flush_handlers

- name: Wait for DNS to be functional
  ansible.builtin.command: getent hosts google.com
  register: dns_check
  until: dns_check.rc == 0
  retries: 3
  delay: 5
  changed_when: false
  tags: [identity, network]

- name: Install baseline packages (Unified list)
  ansible.builtin.apt:
    name: "{{ common_packages }}"
    state: present
    update_cache: yes
    cache_valid_time: 3600
  become: yes
  tags: [packages]

- name: Install fastfetch (Optional - may not be in legacy repos)
  ansible.builtin.apt:
    name:
      - fastfetch
      - btm
    state: present
  become: yes
  ignore_errors: yes
  tags: [packages]

- name: Configure needrestart for non-interactive automation
  ansible.builtin.lineinfile:
    path: /etc/needrestart/needrestart.conf
    regexp: '^#?\$nrconf{restart}'
    line: "$nrconf{restart} = 'a';"
  become: yes
  tags: [packages, config]

- name: Ensure discovery services are enabled and running
  ansible.builtin.service:
    name: "{{ item }}"
    state: started
    enabled: yes
  loop:
    - avahi-daemon
    - lldpd
  become: yes
  tags: [services]

- name: Include maintenance tasks
  ansible.builtin.include_tasks: maintenance.yml
  tags: [maintenance]

- name: Ensure console getty is running (for Proxmox WebUI access)
  ansible.builtin.systemd:
    name: getty@tty1.service
    state: started
    enabled: yes
  become: yes
  tags: [services, setup]

- name: Ensure Node Exporter is running for monitoring
  ansible.builtin.systemd:
    name: prometheus-node-exporter
    state: started
    enabled: yes
  become: yes
  tags: [monitoring, services]


- name: Fix Vim mouse behavior for easy copy-paste
  ansible.builtin.copy:
    dest: /etc/vim/vimrc.local
    content: |
      set mouse=
      syntax on
      set number
    owner: root
    group: root
    mode: '0644'
  become: yes