---
- name: Install ZeroTier binary on Alpine
  hosts: alpine
  become: true
  gather_facts: true

  vars:
    zerotier_version: "1.16.2"
    zerotier_dir: /var/lib/zerotier-one
    zerotier_binary_url: "https://download.zerotier.com/RELEASES/1.4.2/dist/static-binaries/zerotier-one.x86_64.gz"

  tasks:
    - name: Install required packages
      community.general.apk:
        name:
          - ca-certificates
          - curl
          - gzip
          - iproute2
        state: present
        update_cache: true

    - name: Create ZeroTier directories
      ansible.builtin.file:
        path: "{{ item }}"
        state: directory
        owner: root
        group: root
        mode: "0755"
      loop:
        - /usr/local/bin
        - "{{ zerotier_dir }}"

    - name: Download ZeroTier static binary
      ansible.builtin.get_url:
        url: "{{ zerotier_binary_url }}"
        dest: /tmp/zerotier-one.gz
        mode: "0644"
        force: true

    - name: Extract ZeroTier binary
      ansible.builtin.command:
        cmd: gzip -dc /tmp/zerotier-one.gz
      register: zerotier_binary
      changed_when: true
      no_log: true

    - name: Install ZeroTier binary
      ansible.builtin.copy:
        content: "{{ zerotier_binary.stdout }}"
        dest: /usr/local/bin/zerotier-one
        owner: root
        group: root
        mode: "0755"
      no_log: true

    - name: Create ZeroTier CLI symlink
      ansible.builtin.file:
        src: /usr/local/bin/zerotier-one
        dest: /usr/local/bin/zerotier-cli
        state: link

    - name: Create OpenRC service
      ansible.builtin.copy:
        dest: /etc/init.d/zerotier-one
        owner: root
        group: root
        mode: "0755"
        content: |
          #!/sbin/openrc-run

          name="ZeroTier One"
          command="/usr/local/bin/zerotier-one"
          command_args="-d"
          command_background="yes"
          pidfile="/run/zerotier-one.pid"
          directory="{{ zerotier_dir }}"
          output_log="/var/log/zerotier-one.log"
          error_log="/var/log/zerotier-one.log"

    - name: Check TUN device
      ansible.builtin.stat:
        path: /dev/net/tun
      register: zerotier_tun

    - name: Stop if TUN device is missing
      ansible.builtin.fail:
        msg: "ZeroTier binary is installed, but /dev/net/tun is missing. Enable TUN access in the Proxmox LXC configuration before starting the service."
      when: not zerotier_tun.stat.exists

    - name: Enable ZeroTier at boot
      ansible.builtin.command:
        cmd: rc-update add zerotier-one default
      register: zerotier_rc_update
      changed_when: zerotier_rc_update.rc == 0
      failed_when: false

    - name: Start ZeroTier
      ansible.builtin.command:
        cmd: rc-service zerotier-one restart
      register: zerotier_start
      changed_when: zerotier_start.rc == 0

    - name: Verify ZeroTier binary
      ansible.builtin.command:
        cmd: /usr/local/bin/zerotier-one -v
      register: zerotier_version_check
      changed_when: false

    - name: Display installed version
      ansible.builtin.debug:
        var: zerotier_version_check.stdout