---
# description: Install or re-enroll the Steward host agent on an already-provisioned host.
# steward:category: host-agent
# Install (or update) the Steward host agent on a target. Mirrors the
# curl-based install.sh. Pass the per-host registration token as extra-vars:
#   steward_url=https://steward.example  steward_token=<token from Host Agents>
# Re-running updates agent.py in place and restarts the service.
- name: Install Steward host agent
  hosts: all
  become: true
  gather_facts: false
  # steward_token is a per-host inventory var — not declared here, or a play var
  # would outrank and shadow it. steward_url arrives as an extra-var.
  vars:
    steward_url: ""
    agent_interval: 30
  tasks:
    - name: Require steward_url and steward_token
      ansible.builtin.assert:
        that:
          - steward_url | default('') | length > 0
          - steward_token | default('') | length > 0
        fail_msg: "Pass steward_url and steward_token (Steward injects these)."

    - name: Create steward-agent system user
      ansible.builtin.user:
        name: steward-agent
        system: true
        shell: /usr/sbin/nologin
        create_home: false

    # Let the agent read the local Docker socket so it can report this host's
    # containers (the per-host docker collection path). Best-effort: skipped on
    # hosts without Docker. Restart picks up the new supplementary group.
    - name: Detect docker group
      ansible.builtin.command: getent group docker
      register: _docker_grp
      changed_when: false
      failed_when: false

    - name: Add steward-agent to the docker group
      ansible.builtin.user:
        name: steward-agent
        groups: docker
        append: true
      when: _docker_grp.rc == 0
      notify: restart steward-agent

    - name: Create agent directory
      ansible.builtin.file:
        path: /usr/local/lib/steward-agent
        state: directory
        mode: "0755"

    - name: Download agent.py
      ansible.builtin.get_url:
        url: "{{ steward_url }}/plugins/host_agent/agent.py"
        dest: /usr/local/lib/steward-agent/agent.py
        mode: "0755"
        force: true
      notify: restart steward-agent

    - name: Write agent config
      ansible.builtin.copy:
        dest: /etc/steward-agent.conf
        owner: root
        group: steward-agent
        mode: "0640"
        content: |
          url = {{ steward_url }}
          token = {{ steward_token }}
          interval_seconds = {{ agent_interval }}
      notify: restart steward-agent

    - name: Install systemd unit
      ansible.builtin.copy:
        dest: /etc/systemd/system/steward-agent.service
        mode: "0644"
        content: |
          [Unit]
          Description=Steward host agent
          After=network-online.target
          Wants=network-online.target

          [Service]
          Type=simple
          User=steward-agent
          Environment=STEWARD_AGENT_CONFIG=/etc/steward-agent.conf
          ExecStart=/usr/bin/env python3 /usr/local/lib/steward-agent/agent.py
          Restart=on-failure
          RestartSec=5
          NoNewPrivileges=true
          ProtectSystem=strict
          ProtectHome=true
          PrivateTmp=true

          [Install]
          WantedBy=multi-user.target
      notify: restart steward-agent

    - name: Enable and start the agent
      ansible.builtin.systemd:
        name: steward-agent
        enabled: true
        state: started
        daemon_reload: true

  handlers:
    - name: restart steward-agent
      ansible.builtin.systemd:
        name: steward-agent
        state: restarted
        daemon_reload: true