---
- name: Ensure python3-debian is installed (required by deb822_repository)
  ansible.builtin.package:
    name: python3-debian
    state: present
  when: ansible_facts['os_family'] == "Debian"
  tags: [repo_management]

- name: Configure internal/custom yum repositories (RedHat family)
  ansible.builtin.yum_repository:
    name: "{{ item.name }}"
    description: "{{ item.description | default(item.name) }}"
    baseurl: "{{ item.baseurl }}"
    gpgcheck: "{{ item.gpgcheck | default(true) }}"
    gpgkey: "{{ item.gpgkey | default(omit) }}"
    enabled: "{{ item.enabled | default(true) }}"
  loop: "{{ custom_yum_repos }}"
  loop_control:
    label: "{{ item.name }}"
  when: ansible_facts['os_family'] == "RedHat" and custom_yum_repos | length > 0
  tags: [repo_management]

- name: Configure internal/custom apt repositories (Debian family)
  ansible.builtin.deb822_repository:
    name: "{{ item.name }}"
    types: deb
    uris: "{{ item.uris }}"
    suites: "{{ item.suites }}"
    components: "{{ item.components | default(omit) }}"
    signed_by: "{{ item.signed_by | default(omit) }}"
  loop: "{{ custom_apt_repos }}"
  loop_control:
    label: "{{ item.name }}"
  when: ansible_facts['os_family'] == "Debian" and custom_apt_repos | length > 0
  tags: [repo_management]

- name: Probe internet connectivity
  ansible.builtin.uri:
    url: "{{ repo_mgmt_internet_check_url }}"
    method: HEAD
    timeout: 5
    status_code: [200, 301, 302, 403]
  register: repo_management_internet_probe
  failed_when: false
  when: repo_mgmt_check_internet | bool
  tags: [repo_management]

- name: Set internet availability fact
  ansible.builtin.set_fact:
    repo_management_internet_available: "{{ (repo_management_internet_probe is defined) and (repo_management_internet_probe.status is defined) and (repo_management_internet_probe.status | default(0) in [200, 301, 302, 403]) }}"
  tags: [repo_management]

- name: Report internet availability
  ansible.builtin.debug:
    msg: "Internet access on {{ inventory_hostname }}: {{ 'available' if repo_management_internet_available else 'not available / check disabled' }}"
  tags: [repo_management]

- name: Enable CRB repository (RedHat family, internet access required)
  community.general.dnf_config_manager:
    name: crb
    state: enabled
  when:
    - ansible_facts['os_family'] == "RedHat"
    - repo_management_internet_available | default(false)
    - crb_enabled | bool
  tags: [repo_management]

- name: Install EPEL release package (RedHat family, internet access required)
  ansible.builtin.dnf:
    name: "https://dl.fedoraproject.org/pub/epel/epel-release-latest-{{ epel_major_version }}.noarch.rpm"
    state: present
    disable_gpg_check: false
  when:
    - ansible_facts['os_family'] == "RedHat"
    - repo_management_internet_available | default(false)
    - epel_enabled | bool
  tags: [repo_management]

- name: Warn if EPEL/CRB requested but no internet access
  ansible.builtin.debug:
    msg: "EPEL/CRB requested but no internet access detected on {{ inventory_hostname }}. Add an internal mirror via custom_yum_repos instead."
  when:
    - ansible_facts['os_family'] == "RedHat"
    - not (repo_management_internet_available | default(false))
    - (epel_enabled | bool) or (crb_enabled | bool)
  tags: [repo_management]

- name: Enable universe/multiverse components (Ubuntu, internet access required)
  ansible.builtin.deb822_repository:
    name: ubuntu-universe-multiverse
    types: deb
    uris: "http://archive.ubuntu.com/ubuntu"
    suites:
      - "{{ ansible_facts['distribution_release'] }}"
      - "{{ ansible_facts['distribution_release'] }}-updates"
    components:
      - universe
      - multiverse
  when:
    - ansible_facts['distribution'] == "Ubuntu"
    - repo_management_internet_available | default(false)
    - ubuntu_universe_enabled | bool
  tags: [repo_management]

- name: Enable backports component (Debian, internet access required)
  ansible.builtin.deb822_repository:
    name: debian-backports
    types: deb
    uris: "http://deb.debian.org/debian"
    suites: "{{ ansible_facts['distribution_release'] }}-backports"
    components: main
  when:
    - ansible_facts['distribution'] == "Debian"
    - repo_management_internet_available | default(false)
    - debian_backports_enabled | bool
  tags: [repo_management]

- name: Refresh apt cache after repository changes (Debian family)
  ansible.builtin.apt:
    update_cache: true
  when: ansible_facts['os_family'] == "Debian"
  tags: [repo_management]