---
- name: Setup encrypted volume for a13labs
  hosts: linux
  become: true
  vars:
    disk_image_path: /a13labs.img
    disk_image_size: 1G
    luks_device_name: a13labs
    mount_point: /a13labs
    key_file_path: /root/a13labs.key
    key_file_url: https://a13labs-infra-{{ lookup('env','BUCKET_SUFFIX') }}.s3.fr-par.scw.cloud
    key_fetch_service: a13labs-key.service

  tasks:
    - name: Install cryptsetup and curl
      ansible.builtin.apt:
        name:
          - cryptsetup
          - curl
        state: present
      when: ansible_os_family == 'Debian'

    - name: Get mac address
      ansible.builtin.shell: |
        set -o pipefail
        ip link show eth0 | awk '/ether/ {print $2}'
      args:
        executable: /bin/bash
      register: mac_address
      changed_when: false

    - name: Sanitize mac address
      ansible.builtin.set_fact:
        mac_address_sanitized: "{{ mac_address.stdout | regex_replace('[:]', '_') }}"
      changed_when: false

    - name: Create disk image
      ansible.builtin.command: fallocate -l {{ disk_image_size }} {{ disk_image_path }}
      args:
        creates: "{{ disk_image_path }}"
      register: disk_image

    - name: Create bucket URL
      ansible.builtin.set_fact:
        key_file_url: "{{ key_file_url }}/keys/{{ mac_address_sanitized }}.key"
      changed_when: false

    - name: Create encrypted volume # noqa no-handler
      when: disk_image is changed
      block:

        - name: Download key file from Key server
          ansible.builtin.uri:
            url: "{{ key_file_url }}"
            dest: "{{ key_file_path }}"
            mode: '0600'
          args:
            creates: "{{ key_file_path }}"

        - name: Set up LUKS encryption with key file
          ansible.builtin.command: cryptsetup -q luksFormat {{ disk_image_path }} {{ key_file_path }}
          changed_when: false

        - name: Open LUKS device with key file
          ansible.builtin.command: cryptsetup luksOpen {{ disk_image_path }} {{ luks_device_name }} -d {{ key_file_path }}
          register: luks_device
          changed_when: false

        - name: Create file system
          ansible.builtin.command: mkfs.ext4 /dev/mapper/{{ luks_device_name }}
          changed_when: false

        - name: Close LUKS device
          ansible.builtin.command: cryptsetup close {{ luks_device_name }}
          changed_when: false

        - name: Delete key file
          ansible.builtin.file:
            path: "{{ key_file_path }}"
            state: absent

    - name: Create mount point
      ansible.builtin.file:
        path: "{{ mount_point }}"
        state: directory
        mode: "0750"

    - name: Create systemd service to fetch key file and open LUKS device
      ansible.builtin.copy:
        dest: /etc/systemd/system/{{ key_fetch_service }}
        mode: '0644'
        content: |
          [Unit]
          Description=Open LUKS device
          After=network-online.target
          Before=snap.microk8s.daemon-kubelite.service

          [Service]
          Type=oneshot
          RemainAfterExit=true
          ExecStartPre=/usr/bin/curl -o {{ key_file_path }} "{{ key_file_url }}"
          ExecStart=/usr/sbin/cryptsetup luksOpen {{ disk_image_path }} {{ luks_device_name }} -d {{ key_file_path }}
          ExecStartPost=/bin/rm -f {{ key_file_path }}
          ExecStop=/usr/sbin/cryptsetup close {{ luks_device_name }}

          [Install]
          WantedBy=snap.microk8s.daemon-kubelite.service

    - name: Create systemd service to mount the file system
      ansible.builtin.copy:
        dest: /etc/systemd/system/{{ mount_point | basename }}.mount
        mode: '0644'
        content: |
          [Unit]
          Description=Mount LUKS device
          After={{ key_fetch_service }}
          Requires={{ key_fetch_service }}
          Before=snap.microk8s.daemon-kubelite.service

          [Mount]
          What=/dev/mapper/{{ luks_device_name }}
          Where={{ mount_point }}
          Type=ext4
          Options=defaults

          [Install]
          WantedBy=snap.microk8s.daemon-kubelite.service

    - name: Reload systemd daemon
      ansible.builtin.systemd:
        daemon_reload: true

    - name: Enable the key fetch service
      ansible.builtin.systemd:
        name: "{{ key_fetch_service }}"
        enabled: true

    - name: Enable the mount device
      ansible.builtin.systemd:
        name: "{{ mount_point | basename }}.mount"
        enabled: true

    - name: Start the key fetch service
      ansible.builtin.systemd:
        name: "{{ key_fetch_service }}"
        state: started

    - name: Start the mount device
      ansible.builtin.systemd:
        name: "{{ mount_point | basename }}.mount"
        state: started