---
- name: Require versioned artifact and admitted signing-key delivery
  ansible.builtin.assert:
    that:
      - railiance_clock_wheelhouse | length > 0
      - railiance_clock_wheel_sha256 is match('^[0-9a-f]{64}$')
      - railiance_clock_private_key_source | length > 0
      - railiance_clock_kid | length > 0
- name: Create unprivileged authority account
  ansible.builtin.user:
    name: railiance-clock
    system: true
    shell: /usr/sbin/nologin
    create_home: false
- name: Create root-owned install tree
  ansible.builtin.file:
    path: "{{ railiance_clock_install_root }}"
    state: directory
    owner: root
    group: root
    mode: '0755'
- name: Create private signing-key directory
  ansible.builtin.file:
    path: "{{ railiance_clock_state_root }}"
    state: directory
    owner: railiance-clock
    group: railiance-clock
    mode: '0700'
- name: Create public health runtime directory
  ansible.builtin.file:
    path: "{{ railiance_clock_health_root }}"
    state: directory
    owner: root
    group: root
    mode: '0755'
- name: Persist runtime directory creation across boot
  ansible.builtin.copy:
    dest: /etc/tmpfiles.d/railiance-clock.conf
    content: "d {{ railiance_clock_health_root }} 0755 root root -\n"
    owner: root
    group: root
    mode: '0644'
- name: Verify selected wheel checksum on controller
  ansible.builtin.stat:
    path: "{{ railiance_clock_wheelhouse }}/railiance_clock-0.1.0-py3-none-any.whl"
    checksum_algorithm: sha256
  delegate_to: localhost
  become: false
  register: clock_wheel
- name: Refuse artifact drift
  ansible.builtin.assert:
    that: clock_wheel.stat.checksum == railiance_clock_wheel_sha256
- name: Copy offline wheelhouse with locked dependencies
  ansible.builtin.copy:
    src: "{{ railiance_clock_wheelhouse }}/"
    dest: "{{ railiance_clock_install_root }}/wheels/"
    owner: root
    group: root
    mode: '0644'
  register: clock_artifact_copy
- name: Install isolated authority package without network package lookup
  ansible.builtin.pip:
    name: railiance-clock==0.1.0
    state: "{{ 'forcereinstall' if clock_artifact_copy.changed else 'present' }}"
    virtualenv: "{{ railiance_clock_install_root }}/venv"
    virtualenv_command: python3 -m venv
    extra_args: "--no-index --find-links={{ railiance_clock_install_root }}/wheels"
  notify: Restart admitted clock authority
- name: Deliver admitted signing key without logging values
  ansible.builtin.copy:
    src: "{{ railiance_clock_private_key_source }}"
    dest: "{{ railiance_clock_state_root }}/signing.pem"
    owner: railiance-clock
    group: railiance-clock
    mode: '0600'
  no_log: true
  diff: false
  notify: Restart admitted clock authority
- name: Install prebuilt read-only kernel-health probe
  ansible.builtin.copy:
    src: "{{ railiance_clock_wheelhouse }}/railiance-clock-kernel-health"
    dest: "{{ railiance_clock_install_root }}/kernel-health"
    owner: root
    group: root
    mode: '0755'
- name: Write non-secret authority and health policy configuration
  ansible.builtin.template:
    src: "{{ item }}.json.j2"
    dest: "{{ railiance_clock_install_root }}/{{ item }}.json"
    owner: root
    group: root
    mode: '0644'
  loop: [authority, health-policy]
  notify: Restart admitted clock authority
- name: Install host service units
  ansible.builtin.template:
    src: "{{ item }}.j2"
    dest: "/etc/systemd/system/{{ item }}"
    owner: root
    group: root
    mode: '0644'
  loop: [railiance-clock.service, railiance-clock-health.service, railiance-clock-health.timer]
  notify: Reload clock service units
- name: Load changed units before starting
  ansible.builtin.meta: flush_handlers
- name: Export current host health
  ansible.builtin.systemd:
    name: railiance-clock-health.service
    state: started
- name: Enable bounded periodic host-health export
  ansible.builtin.systemd:
    name: railiance-clock-health.timer
    enabled: true
    state: started
- name: Enable private authority
  ansible.builtin.systemd:
    name: railiance-clock.service
    enabled: true
    state: started
- name: Verify usable authority independently of service liveness
  ansible.builtin.uri:
    url: http://127.0.0.1:8787/readyz
    return_content: true
    status_code: 200
  register: clock_ready
  retries: 3
  delay: 2
  until: clock_ready.status == 200