---
# Main stack host: public web + bot-link ports and the external 'edge' network
# the compose stack attaches caddy to.

- name: Open public web and bot-link ports
  community.general.ufw:
    rule: allow
    port: "{{ item }}"
    proto: tcp
  loop:
    - "80"    # HTTP (ACME challenge + redirect to HTTPS)
    - "443"   # HTTPS (caddy edge)
    - "9443"  # bot-link mTLS (remote bot dials in; mutual TLS gates access)

- name: Ensure the external 'edge' docker network exists
  community.docker.docker_network:
    name: edge
    state: present

# --- pgBackRest base-backup schedule (point-in-time recovery) ------------------
# A daily full base backup via a systemd timer that runs pgBackRest inside the postgres
# container; archive_command handles the continuous WAL between backups. Gated by
# pitr_enabled so the schedule stays inert until archiving is armed (the S3 repository +
# stanza must exist first, or the run fails nightly). Arm per deploy/README.md.
- name: Install the pgBackRest base-backup service
  ansible.builtin.template:
    src: pgbackrest-backup.service.j2
    dest: /etc/systemd/system/pgbackrest-backup.service
    mode: "0644"
  when: pitr_enabled | default(false) | bool

- name: Install the pgBackRest base-backup timer
  ansible.builtin.template:
    src: pgbackrest-backup.timer.j2
    dest: /etc/systemd/system/pgbackrest-backup.timer
    mode: "0644"
  when: pitr_enabled | default(false) | bool

- name: Enable and start the pgBackRest base-backup timer
  ansible.builtin.systemd:
    name: pgbackrest-backup.timer
    enabled: true
    state: started
    daemon_reload: true
  when: pitr_enabled | default(false) | bool