---
- name: Install Samba AD DC packages
  ansible.builtin.apt:
    name:
      - samba
      - krb5-user
    state: present
    update_cache: true

- name: Derive child realm from namespace when unset
  ansible.builtin.set_fact:
    samba_ad_dc_child_id: "{{ derived_id | upper }}"
  vars:
    prole_ns: "{{ lookup('env', 'PROLE_NAMESPACE') | default(lookup('env', 'NAMESPACE'), true) | default('', true) }}"
    derived_id: >-
      {{ (prole_ns | regex_findall('^knoe-db-([A-Za-z0-9]+)$') | first)
         | default('', true) }}
  when:
    - samba_ad_dc_child_id is not defined or samba_ad_dc_child_id | length == 0
    - derived_id | length > 0

- name: Check if Samba AD is provisioned
  ansible.builtin.stat:
    path: /var/lib/samba/private/sam.ldb
  register: samba_ad_provisioned

- name: Fail if not provisioned (this role does not provision)
  ansible.builtin.fail:
    msg: |-
      Samba AD is not provisioned on this host (missing /var/lib/samba/private/sam.ldb).
      Provision the child realm first, for example:
        samba-tool domain provision \
          --use-rfc2307 \
          --realm={{ samba_ad_dc_realm }} \
          --domain={{ samba_ad_dc_workgroup }} \
          --server-role=dc \
          --dns-backend=SAMBA_INTERNAL \
          --adminpass='<ansible vault administrator pass>' \
          --parent-realm={{ samba_ad_dc_parent_realm }} \
          --username='{{ samba_ad_dc_parent_netbios }}\\Administrator'
  when: not samba_ad_provisioned.stat.exists

- name: Deploy smb.conf
  ansible.builtin.template:
    src: smb.conf.j2
    dest: /etc/samba/smb.conf
    owner: root
    group: root
    mode: "0644"
  notify: Restart samba-ad-dc

- name: Ensure samba-ad-dc enabled and running
  ansible.builtin.systemd:
    name: samba-ad-dc
    enabled: true
    state: started

- name: Check for kubeadm Samba group
  ansible.builtin.command: >-
    samba-tool group show {{ samba_kubeadm_group }}
    -U {{ samba_dns_admin_user }}%{{ samba_dns_admin_pass }}
  register: samba_kubeadm_group_show
  changed_when: false
  failed_when: false
  when:
    - samba_dns_admin_pass is defined
    - samba_dns_admin_pass | length > 0

- name: Create kubeadm Samba group when missing
  ansible.builtin.command: >-
    samba-tool group add {{ samba_kubeadm_group }}
    -U {{ samba_dns_admin_user }}%{{ samba_dns_admin_pass }}
  when:
    - samba_dns_admin_pass is defined
    - samba_dns_admin_pass | length > 0
    - samba_kubeadm_group_show.rc != 0

- name: List kubeadm Samba group members
  ansible.builtin.command: >-
    samba-tool group listmembers {{ samba_kubeadm_group }}
    -U {{ samba_dns_admin_user }}%{{ samba_dns_admin_pass }}
  register: samba_kubeadm_group_members
  changed_when: false
  when:
    - samba_dns_admin_pass is defined
    - samba_dns_admin_pass | length > 0

- name: Ensure kubeadm Samba group members
  ansible.builtin.command: >-
    samba-tool group addmembers {{ samba_kubeadm_group }} {{ item }}
    -U {{ samba_dns_admin_user }}%{{ samba_dns_admin_pass }}
  loop: "{{ samba_kubeadm_members }}"
  when:
    - samba_dns_admin_pass is defined
    - samba_dns_admin_pass | length > 0
    - samba_kubeadm_members | length > 0
    - item not in (samba_kubeadm_group_members.stdout_lines | default([]))