---
- name: Install S1 backup runtime packages
  ansible.builtin.package:
    name:
      - age
      - python3
      - python3-yaml
    state: present

- name: Create bounded S1 backup directories
  ansible.builtin.file:
    path: "{{ item.path }}"
    state: directory
    owner: root
    group: root
    mode: "{{ item.mode }}"
  loop:
    - {path: /usr/local/lib/railiance-infra/s1-backup/scripts, mode: "0755"}
    - {path: /usr/local/lib/railiance-infra/s1-backup/spec, mode: "0755"}
    - {path: /opt/backup/railiance/infra, mode: "0700"}

- name: Install S1 backup Python implementation
  ansible.builtin.copy:
    src: "{{ playbook_dir }}/../../scripts/{{ item }}"
    dest: "/usr/local/lib/railiance-infra/s1-backup/scripts/{{ item }}"
    owner: root
    group: root
    mode: "0755"
  loop:
    - s1_backup.py
    - s1_backup_contract.py
    - s1_offsite.py
    - s1_restore.py

- name: Install S1 backup declaration
  ansible.builtin.copy:
    src: "{{ playbook_dir }}/../../spec/s1-backup.yaml"
    dest: /usr/local/lib/railiance-infra/s1-backup/spec/s1-backup.yaml
    owner: root
    group: root
    mode: "0644"

- name: Install pending-owner S1 off-site contract metadata
  ansible.builtin.copy:
    src: "{{ playbook_dir }}/../../spec/{{ item }}"
    dest: "/usr/local/lib/railiance-infra/s1-backup/spec/{{ item }}"
    owner: root
    group: root
    mode: "0644"
  loop:
    - s1-offsite.yaml
    - s1-offsite-owner-acceptance.yaml

- name: Install public recipient policy metadata
  ansible.builtin.copy:
    src: "{{ playbook_dir }}/../../.sops.yaml"
    dest: /usr/local/lib/railiance-infra/s1-backup/.sops.yaml
    owner: root
    group: root
    mode: "0644"

- name: Install S1 backup command wrapper
  ansible.builtin.template:
    src: railiance-backup-s1.j2
    dest: /usr/local/sbin/railiance-backup-s1
    owner: root
    group: root
    mode: "0755"

- name: Install S1 backup systemd service
  ansible.builtin.template:
    src: railiance-backup-s1.service.j2
    dest: /etc/systemd/system/railiance-backup-s1.service
    owner: root
    group: root
    mode: "0644"
  notify: Reload systemd for S1 backup

- name: Install S1 backup systemd timer
  ansible.builtin.template:
    src: railiance-backup-s1.timer.j2
    dest: /etc/systemd/system/railiance-backup-s1.timer
    owner: root
    group: root
    mode: "0644"
  notify: Reload systemd for S1 backup

- name: Enable daily S1 backup timer
  ansible.builtin.systemd:
    name: railiance-backup-s1.timer
    enabled: true
    state: started
    daemon_reload: true