---
- name: Install dependencies
  ansible.builtin.apt:
    name:
      - curl
      - ca-certificates
    state: present
    update_cache: true

- name: Create traefik user
  ansible.builtin.user:
    name: traefik
    system: true
    shell: /usr/sbin/nologin
    home: /etc/traefik
    create_home: false

- name: Create traefik directories
  ansible.builtin.file:
    path: "{{ item }}"
    state: directory
    owner: traefik
    group: traefik
    mode: "0750"
  loop:
    - /etc/traefik
    - /etc/traefik/conf.d

- name: Check installed Traefik version
  ansible.builtin.command:
    cmd: /usr/local/bin/traefik version
  register: traefik_installed_version
  changed_when: false
  failed_when: false

- name: Download Traefik binary
  ansible.builtin.get_url:
    url: "https://github.com/traefik/traefik/releases/download/v{{ traefik_version }}/traefik_v{{ traefik_version }}_linux_amd64.tar.gz"
    dest: /tmp/traefik.tar.gz
    mode: "0644"
  when: traefik_version not in (traefik_installed_version.stdout | default(''))

- name: Extract Traefik binary
  ansible.builtin.unarchive:
    src: /tmp/traefik.tar.gz
    dest: /usr/local/bin
    include:
      - traefik
    remote_src: true
    mode: "0755"
  when: traefik_version not in (traefik_installed_version.stdout | default(''))
  notify: Restart traefik

- name: Write Traefik static config
  ansible.builtin.template:
    src: traefik.yml.j2
    dest: /etc/traefik/traefik.yml
    owner: traefik
    group: traefik
    mode: "0640"
  notify: Restart traefik

- name: Write Traefik dynamic routes config
  ansible.builtin.template:
    src: routes.yml.j2
    dest: /etc/traefik/conf.d/routes.yml
    owner: traefik
    group: traefik
    mode: "0640"
  notify: Restart traefik

- name: Write Traefik systemd service
  ansible.builtin.template:
    src: traefik.service.j2
    dest: /etc/systemd/system/traefik.service
    mode: "0644"
  notify:
    - Reload systemd
    - Restart traefik

- name: Enable and start Traefik
  ansible.builtin.systemd:
    name: traefik
    state: started
    enabled: true
    daemon_reload: true