---
# tasks file for ansible-role-mastodon
- name: Check if namespace exists
  kubernetes.core.k8s_info:
    api_version: v1
    kind: Namespace
    name: mastodon
  register: namespace_info
  ignore_errors: yes

- name: Set create_admin_user variable
  set_fact:
    create_admin_user: "{{ namespace_info.resources | length == 0 }}"

- name: Deploy Mastodon
  kubernetes.core.helm:
    name: mastodon
    chart_ref: bitnami/mastodon
    release_namespace: mastodon
    create_namespace: true
    timeout: 1200s
    values:
      global:
        security:
          allowInsecureImages: true
      image:
        pullPolicy: IfNotPresent
        repository: bitnamilegacy/mastodon
        tag: 4.4.3-debian-12-r11
      web:
        resources:
          requests:
            cpu: 0m
            memory: 0Mi
          limits:
            cpu: 2
            memory: 8192Mi
      sidekiq:
        resources:
          requests:
            cpu: 0m
            memory: 0Mi
          limits:
            cpu: 2
            memory: 4096Mi
      initJob:
        migrateAndCreateAdmin:
          createAdmin: "{{ create_admin_user }}"
        precompileAssets:
          resources:
            requests:
              cpu: 0m
              memory: 0Mi
            limits:
              cpu: 1.5
              memory: 8192Mi
      adminUser: mastodon_admin
      adminEmail: mastodon_admin@eom.dev
      adminPassword: "{{ mastodon_admin_password }}"
      otpSecret: "{{ mastodon_otp_secret }}"
      secretKeyBase: "{{ mastodon_secret_key_base }}"
      vapidPrivateKey: "{{ mastodon_vapid_private_key }}"
      vapidPublicKey: "{{ mastodon_vapid_public_key }}"
      activeRecordEncryptionDeterministicKey: "{{ mastodon_active_record_encryption_deterministic_key }}"
      activeRecordEncryptionKeyDerivationSalt: "{{ mastodon_active_record_encryption_key_derivation_salt }}"
      activeRecordEncryptionPrimaryKey: "{{ mastodon_active_record_encryption_primary_key }}"
      useSecureWebSocket: true
      s3AliasHost: minio.eom.dev/mastodon
      extraConfig:
        LDAP_ENABLED: "true"
        LDAP_HOST: openldap.openldap.svc.cluster.local
        LDAP_PORT: "389"
        LDAP_METHOD: plain
        LDAP_BASE: dc=eom,dc=dev
        LDAP_BIND_DN: cn=readonly,dc=eom,dc=dev
        LDAP_PASSWORD: "{{ openldap_readonly_password }}"
        LDAP_UID: uid
        LDAP_SEARCH_FILTER: (&(objectClass=posixAccount)(|(%{uid}=%{email})(%{mail}=%{email}))(memberOf=cn=Mastodon Users,ou=Mastodon,ou=Services,dc=eom,dc=dev))
        LDAP_MAIL: mail
        OIDC_ENABLED: "true"
        # Dex limits this client to a connector that only admits Mastodon Users.
        OIDC_DISPLAY_NAME: eom.dev account
        OIDC_ISSUER: https://dex.eom.dev/
        OIDC_DISCOVERY: "true"
        OIDC_SCOPE: openid,profile,email
        OIDC_UID_FIELD: sub
        OIDC_CLIENT_ID: mastodon
        OIDC_CLIENT_SECRET: "{{ mastodon_dex_client_secret }}"
        # Emails come from LDAP (admin-set or verified by the membership app);
        # lets existing LDAP-login accounts link on first Dex sign-in.
        OIDC_SECURITY_ASSUME_EMAIL_IS_VERIFIED: "true"
        # Sign-in only through Dex; sign-up through the membership site.
        # Admin fallback: tootctl from the web pod.
        OMNIAUTH_ONLY: "true"
        SSO_ACCOUNT_SIGN_UP: https://www.eom.dev/members
        OIDC_REDIRECT_URI: https://mastodon.eom.dev/auth/auth/openid_connect/callback
        AWS_ACCESS_KEY_ID: "{{ mastodon_minio_access_key }}"
        AWS_SECRET_ACCESS_KEY: "{{ mastodon_minio_secret_key }}"
      localDomain: mastodon.eom.dev
      smtp:
        server: postfix.eom.dev
        port: 587
        from_address: mastodon@eom.dev
        domain: postfix.eom.dev
        reply_to: mastodon@eom.dev
        delivery_method: smtp
        tls: true
        auth_method: starttls
        login: mastodon
        password: "{{ mastodon_admin_password }}"
      persistence:
        enabled: true
        size: 2Ti
      redis:
        image:
          repository: bitnamilegacy/redis
          tag: 8.2.0-debian-12-r0
        enabled: true
        auth:
          password: "{{ mastodon_admin_password }}"
      postgresql:
        enabled: true
        image:
          repository: bitnamilegacy/postgresql
        auth:
          username: mastodon
          password: "{{ mastodon_admin_password }}"
          database: mastodon
        primary:
          persistence:
            enabled: true
            size: 2Ti
      elasticsearch:
        enabled: true
        repository: bitnamilegacy/elasticsearch
        master:
          persistence:
            size: 2Ti
        data:
          persistence:
            size: 2Ti
      minio:
        enabled: false
      externalS3:
        host: minio.eom.dev
        accessKeyId: "{{ mastodon_minio_access_key }}"
        accessKeySecret: "{{ mastodon_minio_secret_key }}"
      apache:
        image:
          repository: bitnamilegacy/apache
        service:
          type: ClusterIP
          ports:
            http: 80
        ingress:
          enabled: true
          hostname: mastodon.eom.dev
          annotations:
            kubernetes.io/ingress.class: nginx
            cert-manager.io/cluster-issuer: ca-issuer
            nginx.ingress.kubernetes.io/proxy-body-size: 8m
          tls:
            - hosts:
              - mastodon.eom.dev
              secretName: mastodon-tls


# With registrations "open", the web UI's Create account button links to
# SSO_ACCOUNT_SIGN_UP (www.eom.dev/members) instead of a "closed" dialog.
# OMNIAUTH_ONLY still disables local sign-up; accounts come only via Dex.
- name: Find the Mastodon web pod
  kubernetes.core.k8s_info:
    kind: Pod
    namespace: mastodon
    label_selectors:
      - app.kubernetes.io/component=web
      - app.kubernetes.io/instance=mastodon
    field_selectors:
      - status.phase=Running
  register: mastodon_web_pods

- name: Open registrations so sign-up links to the membership site
  kubernetes.core.k8s_exec:
    namespace: mastodon
    pod: "{{ mastodon_web_pods.resources[0].metadata.name }}"
    container: mastodon
    # kubectl exec skips the image entrypoint, so load the password files.
    command: >-
      sh -c 'export REDIS_PASSWORD="$(cat "$MASTODON_REDIS_PASSWORD_FILE")"
      DB_PASS="$(cat "$MASTODON_DATABASE_PASSWORD_FILE")" HOME=/tmp;
      tootctl settings registrations open'
  changed_when: false