- name: install keycloak
  gather_facts: no
  hosts: "{{target}}"
  become: "{{become_var}}"
  tasks:

  - name: package requirements
    package:
      name:
        - binutils              # using strings to check for build
        - default-jre-headless  # keycloak runs redhat jboss
        - htop                  # eats quite some resources

  # todo - avoid that changed in check mode
  - name: create keycloak group
    shell:
      cmd: |
        set -e
        if [[ -z `grep ^keycloak: /etc/group` ]]; then
          groupadd keycloak
        fi

  # todo - avoid that changed in check mode
  - name: create keycloak user
    shell:
      cmd: |
        set -e
        if [[ -z `grep ^keycloak: /etc/passwd` ]]; then
          useradd --system -g keycloak -d /opt/keycloak -s /sbin/nologin keycloak
        fi

  - name: grab keycloak version {{kc_ver}}
    shell:
      cmd: |
        set -e
        cd /opt/
        wget https://github.com/keycloak/keycloak/releases/download/{{kc_ver}}/keycloak-{{kc_ver}}.tar.gz
      creates: /opt/keycloak-{{kc_ver}}.tar.gz

  # expected user was UID 1001, which is not necessarily what we have 
  # todo - split-up the chown somewhere else
  - name: extract keycloak version {{kc_ver}}
    shell:
      cmd: |
        set -e
        cd /opt/
        tar xzf keycloak-{{kc_ver}}.tar.gz
        cd keycloak-{{kc_ver}}/
        mkdir -p data/
        chown -R keycloak:keycloak LICENSE.txt README.md bin/ data/ lib/ version.txt
      creates: /opt/keycloak-{{kc_ver}}/

  - name: symlink as /opt/keycloak
    shell:
      cmd: ln -s keycloak-{{kc_ver}} /opt/keycloak
      creates: /opt/keycloak/

  #Binary files keycloak-26.6.3_before_start/lib/quarkus/generated-bytecode.jar and keycloak-26.6.3/lib/quarkus/generated-bytecode.jar differ
  #Binary files keycloak-26.6.3_before_start/lib/quarkus/quarkus-application.dat and keycloak-26.6.3/lib/quarkus/quarkus-application.dat differ
  #Binary files keycloak-26.6.3_before_start/lib/quarkus/transformed-bytecode.jar and keycloak-26.6.3/lib/quarkus/transformed-bytecode.jar differ
  - name: check for build
    shell:
      cmd: |
        set -e
        cd /opt/keycloak/
        strings lib/quarkus/generated-bytecode.jar | \
          grep ^META-INF/keycloak-persisted.propertiesPK
    register: output
    changed_when: false
    check_mode: false

  - debug: var=output.stdout

  # required as first shot, even before bootstrapping an admin user
  # doesn't require the database to be up just yet
  - name: build
    shell:
      cmd: |
        set -e
        cd /opt/keycloak/bin/
        time ./kc.sh build --db mariadb
    when: output.stdout != 'META-INF/keycloak-persisted.propertiesPK'

  # todo - use /opt/keycloak/conf/ instead of crazy unit?
  # define kc_tmp_admin and credentials initially,
  # this is required as second shot just to get an admin user
  # and this won't work if you've already started kc once without it...
  # worst case scenario you will have to reach the service on localhost to reach the ui
  # and create the temp admin user
  - name: deploy unit
    template:
      src: keycloak.service
      dest: /etc/systemd/system/keycloak.service
      # credentials in there
      mode: "0600"
    notify: reload units

  - name: handy log wrapper
    copy:
      content: |
        journalctl -xeu keycloak -n100 -f
      dest: /root/logkeycloak
      mode: "0755"

  handlers:

  - name: reload units
    command: systemctl daemon-reload