---
- name: Install ZeroTier on Alpine hosts using Docker
  hosts: alpine
  become: true
  gather_facts: true

  tasks:
    - name: Verify Alpine Linux
      ansible.builtin.assert:
        that:
          - ansible_facts["distribution"] == "Alpine"
          - ansible_facts["architecture"] == "x86_64"

    - name: Ensure persistent ZeroTier directory exists
      ansible.builtin.file:
        path: /opt/zerotier-one
        state: directory
        owner: root
        group: root
        mode: "0700"

    - name: Ensure TUN device exists
      ansible.builtin.stat:
        path: /dev/net/tun
      register: zerotier_tun

    - name: Fail if TUN device is unavailable
      ansible.builtin.fail:
        msg: "Enable /dev/net/tun on this host or its Proxmox LXC configuration first."
      when: not zerotier_tun.stat.exists

    - name: Pull ZeroTier container image
      community.docker.docker_image:
        name: zyclonite/zerotier:1.14.2
        source: pull

    - name: Run ZeroTier container
      community.docker.docker_container:
        name: zerotier
        image: zyclonite/zerotier:1.14.2
        state: started
        restart_policy: unless-stopped
        network_mode: host
        capabilities:
          - NET_ADMIN
          - SYS_ADMIN
        devices:
          - /dev/net/tun:/dev/net/tun
        volumes:
          - /opt/zerotier-one:/var/lib/zerotier-one