---
- name: Validate the Prometheus Gitea SSH cutover inputs
  tags: [services, gitea_cutover]
  ansible.builtin.assert:
    that:
      - server_gitea_cutover_tools_enabled | bool
      - server_gitea_atlas_address is match('^[0-9]{1,3}(\.[0-9]{1,3}){3}$')
      - server_gitea_ssh_public_port | int > 1024
      - server_gitea_ssh_public_port | int < 65536
      - server_gitea_ssh_target_port | int > 1024
      - server_gitea_ssh_target_port | int < 65536
      - server_gitea_ssh_public_port | int != 22
    fail_msg: Keep administrative SSH on 22 and provide the Atlas rootless Gitea SSH endpoint.
  when: server_gitea_on_atlas | bool

- name: Install the Gitea SSH socket proxy units without activating them
  tags: [services, gitea_cutover]
  ansible.builtin.template:
    src: "{{ item }}.j2"
    dest: "/etc/systemd/system/{{ item }}"
    owner: root
    group: root
    mode: "0644"
  loop:
    - prometheus-gitea-ssh-proxy.socket
    - prometheus-gitea-ssh-proxy.service
  loop_control:
    label: "{{ item }}"
  register: server_gitea_ssh_proxy_units
  when: server_gitea_cutover_tools_enabled | bool

- name: Reload systemd after Gitea SSH proxy unit changes
  tags: [services, gitea_cutover]
  ansible.builtin.systemd:
    daemon_reload: true
  when:
    - server_gitea_cutover_tools_enabled | bool
    - server_gitea_ssh_proxy_units is changed
    - not ansible_check_mode

- name: Manage the public Gitea SSH socket separately from administrative SSH
  tags: [services, gitea_cutover]
  ansible.builtin.systemd:
    name: prometheus-gitea-ssh-proxy.socket
    state: "{{ 'started' if server_gitea_on_atlas | bool else 'stopped' }}"
    enabled: "{{ server_gitea_on_atlas | bool }}"
  when:
    - server_gitea_cutover_tools_enabled | bool
    - not ansible_check_mode

- name: Open only the public Gitea SSH port after cutover
  tags: [services, gitea_cutover]
  ansible.posix.firewalld:
    port: "{{ server_gitea_ssh_public_port }}/tcp"
    zone: "{{ server_firewalld_zone }}"
    state: "{{ 'enabled' if server_gitea_on_atlas | bool else 'disabled' }}"
    permanent: true
    immediate: true
  when:
    - server_gitea_cutover_tools_enabled | bool
    - server_firewall_backend == 'firewalld'