---
- name: Install prerequisite packages
  ansible.builtin.dnf:
    name:
      - curl
      - policycoreutils-python-utils
      - openssh-server
      - perl
      - firewalld
    state: present
  tags: [gitlab_install]

- name: Configure the GitLab package repository
  ansible.builtin.yum_repository:
    name: "gitlab_gitlab-{{ gitlab_install_edition }}"
    description: "GitLab {{ gitlab_install_edition | upper }} packages"
    baseurl: "https://packages.gitlab.com/gitlab/gitlab-{{ gitlab_install_edition }}/el/$releasever/$basearch"
    gpgcheck: true
    repo_gpgcheck: true
    gpgkey: "https://packages.gitlab.com/gitlab/gitlab-{{ gitlab_install_edition }}/gpgkey"
    sslverify: true
    enabled: true
  tags: [gitlab_install]

- name: Install GitLab
  ansible.builtin.dnf:
    name: "gitlab-{{ gitlab_install_edition }}{{ ('-' + gitlab_install_version) if gitlab_install_version | length > 0 else '' }}"
    state: present
  tags: [gitlab_install]

- name: Deploy gitlab.rb configuration
  ansible.builtin.template:
    src: gitlab.rb.j2
    dest: /etc/gitlab/gitlab.rb
    owner: root
    group: root
    mode: "0600"
  notify: reconfigure gitlab
  tags: [gitlab_install]

- name: Open firewall ports for HTTP/HTTPS
  ansible.posix.firewalld:
    zone: "{{ firewall_default_zone }}"
    service: "{{ item }}"
    permanent: true
    immediate: true
    state: enabled
  loop:
    - http
    - https
  tags: [gitlab_install]

- name: Flush handlers to apply gitlab.rb changes now
  ansible.builtin.meta: flush_handlers
  tags: [gitlab_install]

- name: Wait for GitLab to report healthy
  ansible.builtin.uri:
    url: "{{ gitlab_install_external_url }}/-/health"
    validate_certs: false
    status_code: 200
  register: gitlab_install_health
  until: gitlab_install_health.status == 200
  retries: 30
  delay: 20
  tags: [gitlab_install]

- name: Report GitLab access details
  ansible.builtin.debug:
    msg: >-
      GitLab is reachable at {{ gitlab_install_external_url }} with user 'root'.
      Initial password is stored in vault/secrets.yml (gitlab_root_password) -
      change it on first login.
  tags: [gitlab_install]