- name: Deploy Newt (Pangolin tunnel agent)
  hosts: all
  become: true

  vars:
    newt_stack_dir: "/opt/stacks/newt"
    pangolin_endpoint: "https://pangolin.wulfconsulting.cloud"

  pre_tasks:
    - name: Fail if newt_id is not set
      fail:
        msg: "newt_id is required. Pass it via -e newt_id=..."
      when: newt_id is not defined or newt_id | length == 0

    - name: Fail if newt_secret is not set
      fail:
        msg: "newt_secret is required. Pass it via -e newt_secret=..."
      when: newt_secret is not defined or newt_secret | length == 0

    - name: Fail if pangolin_endpoint is not set
      fail:
        msg: "pangolin_endpoint is required. Pass it via -e pangolin_endpoint=..."
      when: pangolin_endpoint is not defined or pangolin_endpoint | length == 0

    - name: Verify Docker is running
      service_facts:

    - name: Fail if Docker service is not running
      fail:
        msg: "Docker is not running on this host."
      when: "'docker.service' not in ansible_facts.services or ansible_facts.services['docker.service'].state != 'running'"

  tasks:
    - name: Create stack directory
      file:
        path: "{{ newt_stack_dir }}"
        state: directory
        mode: "0755"

    - name: Ensure pangolin Docker network exists
      community.docker.docker_network:
        name: pangolin
        driver: bridge
        state: present

    - name: Write compose.yaml
      copy:
        dest: "{{ newt_stack_dir }}/compose.yaml"
        mode: "0644"
        content: |
          networks:
            pangolin:
              external: true

          services:
            newt:
              image: fosrl/newt
              container_name: newt
              restart: unless-stopped
              networks:
                - pangolin
              environment:
                PANGOLIN_ENDPOINT: {{ pangolin_endpoint }}
                NEWT_ID: {{ newt_id }}
                NEWT_SECRET: {{ newt_secret }}

    - name: Deploy Newt stack
      community.docker.docker_compose_v2:
        project_src: "{{ newt_stack_dir }}"
        pull: always
        build: never
        state: present