- name: "Setup password-less SSH port forwarding from {{ relay_host }} to {{ inventory_hostname }}"
  tags:
    - ssh
  ansible.builtin.include_role:
    name: ssh_relay_access
    apply:
      delegate_to: "{{ relay_host }}"
      tags:
        - relayed_domain
  # prefix the variables with their role name to prevent scoping issues
  vars:
    ssh_relay_accessing_host: "{{ relay_host }}"
    ssh_relay_accessed_host: "{{ inventory_hostname }}"
    ssh_relay_accessed_user: "{{ ansible_user }}"

- name: "Configure the SSH access from {{ relay_host }} to {{ inventory_hostname }}"
  tags:
    - ssh
  block:
    - name: "Authorize the {{ relay_host }} host key at {{ inventory_hostname }}"
      ansible.builtin.include_role:
        name: ssh_authorize_host
        apply:
          delegate_to: "{{ relay_host }}"
          tags:
            - relayed_domain
      vars:
        ssh_relayed_hostname: "{{ inventory_hostname }}"
        ssh_hostname: "{{ relay_host }}"
        ssh_port: "{{ relayed_host_ssh_port }}"

    - name: "Add {{ inventory_hostname }} to {{ relay_host }}'s ssh config"
      delegate_to: "{{ relay_host }}"
      ansible.builtin.blockinfile:
        create: true
        mode: '600'
        path: ~/.ssh/config
        marker: "# {mark} ANSIBLE MANAGED BLOCK {{ inventory_hostname }}"
        block: |
          Host {{ inventory_hostname }}
            User {{ ansible_user }}
            Port {{ relayed_host_ssh_port }}
            IdentityFile ~/.ssh/{{ relay_ssh_key_name }}

- name: "Add relayed domain ({{ domain }}) to {{ relay_host }}"
  ansible.builtin.include_role:
    name: uberspace_domains
    apply:
      delegate_to: "{{ relay_host }}"
      tags:
        - relayed_domain
    tasks_from: web
  vars:
    domains:
      - "{{ domain }}"

- name: Add web backend for the relayed domain to the relay port
  tags:
    - ssh
  delegate_to: "{{ relay_host }}"
  # TODO: detect if this is necessary
  ansible.builtin.command:
    cmd: "uberspace web backend set {{ domain }} --http --port {{ relay_port }}"

- name: Setup port forward service useing supervisorctl
  tags:
    - ssh
  delegate_to: "{{ relay_host }}"
  block:
    - name: Install service file
      ansible.builtin.template:
        src: forward-service.ini.j2
        dest: "~/etc/services.d/forward-{{ relay_port }}-to-{{ inventory_hostname }}-{{ relayed_port }}.ini"
        mode: '644'
      register: forward_service

    - name: Ensure port forward service is running
      community.general.supervisorctl:
        name: "forward-{{ relay_port }}-to-{{ inventory_hostname }}-{{ relayed_port }}"
        state: "{{ 'restarted' if forward_service.changed else 'started' }}"