---
- name: Create group
  ansible.builtin.group:
    name: nodered

- name: Create user
  ansible.builtin.user:
    name: nodered
    comment: Podman NodeRed
    group: nodered
    shell: /sbin/nologin

- name: Enable user lingering
  ansible.builtin.command:
    argv:
      - loginctl
      - enable-linger
      - nodered
    creates: /var/lib/systemd/linger/nodered

- name: Fix SELinux contexts from config directory
  community.general.sefcontext:
    path: /export/nodered(/.*)?
    setype: container_file_t
  when: ansible_selinux_python_present

- name: Get subgid number
  ansible.builtin.command:
    argv:
      - awk
      - "-F:"
      - '{ if ($1 == "nodered") print $2 + 999 }'
      - /etc/subgid
  changed_when: false
  register: subgid

- name: Create config directory
  ansible.builtin.file:
    path: /export/nodered
    state: directory
    mode: "0770"
    owner: root
    group: "{{ subgid.stdout }}"
    setype: _default

- name: Link config directory
  ansible.builtin.file:
    dest: /srv/nodered
    src: /export/nodered
    state: link
    owner: root
    group: "{{ ansible_wheel }}"
    follow: false

- name: Create service file
  ansible.builtin.template:
    dest: /etc/systemd/system/nodered-container.service
    src: nodered-container.service.j2
    mode: "0644"
    owner: root
    group: "{{ ansible_wheel }}"
  notify: Restart nodered

- name: Enable service
  ansible.builtin.service:
    name: nodered-container
    state: started
    enabled: true

- name: Copy nginx config
  ansible.builtin.copy:
    dest: "/etc/nginx/conf.d/{{ inventory_hostname }}/00-nodered.conf"
    content: |
      location /nodered/ {
        proxy_pass http://127.0.0.1:8012/;
      }
    mode: "0644"
    owner: root
    group: "{{ ansible_wheel }}"
  notify: Restart nginx