{# steward/templates/settings/ansible.html #}
{% extends "base.html" %}
{% block title %}Settings — Ansible — Steward{% endblock %}
{% block content %}
{% set active_tab = "ansible" %}
{% include "settings/_tabs.html" %}

<div style="max-width:720px;">
  <div style="display:flex;align-items:baseline;justify-content:space-between;margin-bottom:0.75rem;">
    <div class="section-title">Ansible Sources</div>
    <a href="/ansible/" class="btn btn-ghost btn-sm" style="font-size:0.78rem;">Run History →</a>
  </div>
  <p style="color:var(--text-muted);font-size:0.84rem;margin-bottom:1rem;">
    Sources are directories of playbooks — either a local path or a git repository
    cloned automatically. Add as many as you need; each can be browsed and run independently.
  </p>
  {% include "settings/_ansible_sources.html" %}

  {# ── Credentials ──────────────────────────────────────────────────────────── #}
  {% set cfg_badge = '<span style="color:var(--green);font-size:0.72rem;">(configured)</span>' %}
  {% set not_set_badge = '<span style="color:var(--text-muted);font-size:0.72rem;">(not set)</span>' %}
  <div style="margin-top:2.25rem;">
    <div class="section-title" style="margin-bottom:0.75rem;">Credentials</div>
    <p style="color:var(--text-muted);font-size:0.84rem;margin-bottom:1rem;">
      Used by every playbook run (manual and alert-triggered). Stored on the server and
      never shown again after saving — leave a field blank to keep the current value.
    </p>
    <form method="post" action="/settings/ansible/credentials">
      <div class="form-group">
        <label>SSH private key {{ (cfg_badge if ssh_key_set else not_set_badge) | safe }}</label>
        <textarea name="ssh_private_key" rows="4"
                  placeholder="-----BEGIN OPENSSH PRIVATE KEY----- …  (blank = keep current)"
                  style="width:100%;font-family:ui-monospace,monospace;font-size:0.8rem;"></textarea>
        {% if ssh_key_set %}
        <label style="font-weight:normal;font-size:0.8rem;color:var(--text-muted);">
          <input type="checkbox" name="clear_ssh_private_key"> Clear stored key</label>
        {% endif %}
      </div>
      <div class="form-group">
        <label>Become / sudo password {{ (cfg_badge if become_set else not_set_badge) | safe }}</label>
        <input type="password" name="become_password" autocomplete="new-password"
               placeholder="blank = keep current">
        {% if become_set %}
        <label style="font-weight:normal;font-size:0.8rem;color:var(--text-muted);">
          <input type="checkbox" name="clear_become_password"> Clear</label>
        {% endif %}
      </div>
      <div class="form-group">
        <label>Vault password {{ (cfg_badge if vault_set else not_set_badge) | safe }}</label>
        <input type="password" name="vault_password" autocomplete="new-password"
               placeholder="blank = keep current">
        {% if vault_set %}
        <label style="font-weight:normal;font-size:0.8rem;color:var(--text-muted);">
          <input type="checkbox" name="clear_vault_password"> Clear</label>
        {% endif %}
      </div>
      <div class="form-group">
        <label style="display:flex;align-items:center;gap:0.5rem;font-weight:normal;">
          <input type="checkbox" name="host_key_checking" {% if host_key_checking %}checked{% endif %}>
          Enforce SSH host-key checking <span style="color:var(--text-muted);font-size:0.78rem;">(off by default for homelab convenience)</span>
        </label>
      </div>
      <button type="submit" class="btn">Save credentials</button>
    </form>
  </div>
</div>
{% endblock %}