- import_role:
    name: jail
    tasks_from: jail_setup

- name: Create storage group
  shell: "pw groupshow storage || pw groupadd storage -g 1001"
  register: _storage_group
  changed_when: "'storage' not in _storage_group.stdout"

- name: Create storage user
  shell: "id storage || pw useradd storage -u 1001 -g 1001 -d / -s /bin/sh"
  register: _storage_user
  changed_when: _storage_user.rc != 0

- name: Add service users to storage group
  shell: "pw groupmod storage -m sonarr,radarr,lidarr,transmission"
  changed_when: false

- name: Configure transmission to run as storage user
  community.general.sysrc:
    name: transmission_user
    value: storage

- name: Fix transmission config directory ownership
  file:
    path: /usr/local/etc/transmission/home
    state: directory
    owner: storage
    group: storage
    recurse: true

- name: Configure transmission download directory
  community.general.sysrc:
    name: transmission_download_dir
    value: /mnt/storage/downloads/complete

- name: Deploy initial transmission settings
  template:
    src: "{{ jail_role_dir }}/templates/transmission_settings.json.j2"
    dest: /usr/local/etc/transmission/home/settings.json
    owner: root
    group: wheel
    mode: "0644"
  notify: Restart transmission

- name: Deploy nzbget config
  template:
    src: "{{ jail_role_dir }}/templates/usr_local_share_nzbget_nzbget.conf.j2"
    dest: /usr/local/etc/nzbget.conf
    owner: root
    group: wheel
    mode: "0444"
  notify: Restart nzbget

- name: Create nzbget data directory
  file:
    path: /var/db/nzbget
    state: directory
    owner: storage
    group: storage
    mode: "0755"

- name: Configure nzbget config path
  community.general.sysrc:
    name: nzbget_conf
    value: /usr/local/etc/nzbget.conf
  notify: Restart nzbget

- name: Configure nzbget user
  community.general.sysrc:
    name: nzbget_user
    value: storage
  notify: Restart nzbget

- name: Deploy initial prowlarr config
  template:
    src: "{{ jail_role_dir }}/templates/prowlarr_config.xml.j2"
    dest: /usr/local/prowlarr/config.xml
    owner: prowlarr
    group: prowlarr
    mode: "0644"
  notify: Restart prowlarr

- name: Deploy initial sonarr config
  template:
    src: "{{ jail_role_dir }}/templates/sonarr_config.xml.j2"
    dest: /usr/local/sonarr/config.xml
    owner: sonarr
    group: sonarr
    mode: "0644"
  notify: Restart sonarr

- name: Deploy initial radarr config
  template:
    src: "{{ jail_role_dir }}/templates/radarr_config.xml.j2"
    dest: /usr/local/radarr/config.xml
    owner: radarr
    group: radarr
    mode: "0644"
  notify: Restart radarr

- name: Deploy initial lidarr config
  template:
    src: "{{ jail_role_dir }}/templates/lidarr_config.xml.j2"
    dest: /usr/local/lidarr/config.xml
    owner: lidarr
    group: lidarr
    mode: "0644"
  notify: Restart lidarr

# Replace bundled ffprobe with system version (bundled version lacks VVC/xHE-AAC support)
- name: Replace bundled ffprobe with system ffprobe
  file:
    src: /usr/local/bin/ffprobe
    dest: "/usr/local/share/{{ item }}/bin/ffprobe"
    state: link
    force: true
  loop:
    - sonarr
    - radarr
  notify:
    - Restart sonarr
    - Restart radarr

- name: Create wireguard config directory
  file:
    path: /usr/local/etc/wireguard
    state: directory
    owner: root
    group: wheel
    mode: "0700"

- name: Deploy wireguard configs
  unarchive:
    src: "{{ jail_role_dir }}/files/mullvad_wireguard_linux_all_all.zip"
    dest: /usr/local/etc/wireguard
    owner: root
    group: wheel
    mode: "0600"
    creates: /usr/local/etc/wireguard/mullvad-fi1.conf

- name: Deploy wg_random_tunnel script
  template:
    src: "{{ jail_role_dir }}/templates/wg_random_tunnel.j2"
    dest: /usr/local/bin/wg_random_tunnel
    owner: root
    group: wheel
    mode: "0755"
  notify: Get random wireguard tunnel

- name: Deploy wg_random_tunnel rc.d script
  template:
    src: "{{ jail_role_dir }}/templates/usr_local_etc_rc.d_wg_random_tunnel"
    dest: /usr/local/etc/rc.d/wg_random_tunnel
    owner: root
    group: wheel
    mode: "0755"
  notify: Get random wireguard tunnel

- name: Deploy fix-library-permissions script
  copy:
    src: "{{ jail_role_dir }}/files/fix-library-permissions.sh"
    dest: /usr/local/bin/fix-library-permissions.sh
    owner: root
    group: wheel
    mode: "0755"

- name: Deploy crontab
  template:
    src: "{{ jail_role_dir }}/templates/etc_crontab.j2"
    dest: /etc/crontab
    owner: root
    group: wheel
    mode: "0644"

- import_role:
    name: jail
    tasks_from: jail_launch