---
- name: Create LUKS encrypted file system with key file fetched from HTTP server
  hosts: contabo
  become: yes
  vars:
    disk_image_path: /a13labs.img
    disk_image_size: 1G
    luks_device_name: luks_device
    mount_point: /a13labs
    key_file_path: /root/luks_keyfile
    key_file_url: https://a13labs-infra-{{ lookup('env','BUCKET_SUFFIX') }}.s3.fr-par.scw.cloud
    key_fetch_service: fetch-a13labs-key.service

  tasks:
    - name: Install cryptsetup and curl
      apt:
        name:
          - cryptsetup
          - curl
        state: present
      when: ansible_os_family == 'Debian'

    - name: Create disk image
      ansible.builtin.command: fallocate -l {{ disk_image_size }} {{ disk_image_path }}
      args:
        creates: "{{ disk_image_path }}"
      register: disk_image

    - name: Create encrypted volume
      when: disk_image is changed
      block: 
      - name: Get mac address
        ansible.builtin.shell: |
          set -o pipefail        
          ip link show eth0 | awk '/ether/ {print $2}'
        args:
          executable: /bin/bash
        register: mac_address
        changed_when: false

      - name: Sanitize mac address
        set_fact:
          mac_address_sanitized: "{{ mac_address.stdout | regex_replace('[:]', '%3A') }}"
        changed_when: false

      - name: Create bucket URL
        set_fact:
          key_file_url: "{{ key_file_url }}/keys/{{ mac_address_sanitized }}.key"
        changed_when: false

      - name: Download key file from HTTP server
        ansible.builtin.uri:
          url: "{{ key_file_url }}"
          dest: "{{ key_file_path }}"
          mode: '0600'
        args:
          creates: "{{ key_file_path }}"

      - name: Set up LUKS encryption with key file
        ansible.builtin.command: cryptsetup -q luksFormat {{ disk_image_path }} {{ key_file_path }}

      - name: Open LUKS device with key file
        ansible.builtin.command: cryptsetup luksOpen {{ disk_image_path }} {{ luks_device_name }} -d {{ key_file_path }}
        register: luks_device

      - name: Delete key file
        ansible.builtin.file:
          path: "{{ key_file_path }}"
          state: absent

      - name: Create file system
        ansible.builtin.command: mkfs.ext4 /dev/mapper/{{ luks_device_name }}

      - name: Create mount point
        file:
          path: "{{ mount_point }}"
          state: directory

      - name: Mount the file system
        ansible.builtin.command: mount /dev/mapper/{{ luks_device_name }} {{ mount_point }}

      - name: Ensure the file system is mounted
        mount:
          path: "{{ mount_point }}"
          src: /dev/mapper/{{ luks_device_name }}
          fstype: ext4
          state: mounted

      - name: Create systemd service to fetch key file and open LUKS device
        copy:
          dest: /etc/systemd/system/{{ key_fetch_service }}
          content: |
            [Unit]
            Description=Fetch LUKS key file from HTTP server and open LUKS device
            After=network-online.target
            Before=cryptsetup.target

            [Service]
            Type=oneshot
            ExecStartPre=/usr/bin/curl -o {{ key_file_path }} {{ key_file_url }}
            ExecStart=/usr/bin/cryptsetup luksOpen {{ disk_image_path }} {{ luks_device_name }} -d {{ key_file_path }}
            ExecStartPost=/bin/rm -f {{ key_file_path }}

            [Install]
            WantedBy=multi-user.target

      - name: Reload systemd daemon
        ansible.builtin.command: systemctl daemon-reload

      - name: Enable the key fetch service
        ansible.builtin.command: systemctl enable {{ key_fetch_service }}

      - name: Add entry to /etc/fstab
        lineinfile:
          path: /etc/fstab
          line: "/dev/mapper/{{ luks_device_name }} {{ mount_point }} ext4 defaults 0 2"
          create: yes