---
- name: Deploy Paperclip stack (behind the shared nginx-proxy)
  hosts: illuminations
  become: true
  vars_files:
    - "{{ playbook_dir }}/../group_vars/all/vars"
    - "{{ playbook_dir }}/../group_vars/all/vault"

  roles:
    - docker-host
    - nginx-proxy        # must come before paperclip-docker (it publishes its vhost through it)
    - paperclip-docker

  post_tasks:
    # CLI-based on purpose: community.docker.docker_container_info needs the
    # Docker SDK for Python, which the paperclip-docker role no longer installs.
    - name: Verify stack containers are running
      ansible.builtin.command: "docker inspect -f '{% raw %}{{.State.Running}}{% endraw %}' {{ item }}"
      register: container_status
      loop:
        - paperclip-db
        - paperclip
        - nginx
        - certbot
      changed_when: false
      failed_when: container_status.rc != 0 or container_status.stdout | trim != 'true'
      loop_control:
        label: "{{ item }}"

    - name: Verify Docker is available
      ansible.builtin.command: docker --version
      register: docker_version
      changed_when: false

    - name: Show Docker version
      ansible.builtin.debug:
        msg: "Docker version: {{ docker_version.stdout }}"

    - name: Verify docker-compose plugin is available
      ansible.builtin.command: docker compose version
      register: compose_version
      changed_when: false
      ignore_errors: true

    - name: Show docker-compose version
      ansible.builtin.debug:
        msg: "Docker Compose version: {{ compose_version.stdout | default('docker-compose plugin not found') }}"

    - name: Display deployment summary
      ansible.builtin.debug:
        msg: |
          Paperclip stack deployed successfully!

          Access points:
            - HTTPS: https://{{ paperclip_domain }}
            - HTTP (redirects to HTTPS): http://{{ paperclip_domain }}

          Services:
            - Paperclip: {{ paperclip_host }}:{{ paperclip_port }}
            - nginx (shared reverse proxy): 0.0.0.0:443 / 0.0.0.0:80, config in {{ nginx_proxy_conf_dir }}
            - certbot: Running certificate renewal checks

          Data location:
            - {{ paperclip_base_path }}/data

          Certificates:
            - {{ nginx_proxy_certs_dir }}/live/{{ paperclip_domain }}/

          vLLM endpoint:
            - {{ vllm_endpoint }}

          OpenCode configuration:
            - Config: {{ paperclip_base_path }}/.config/opencode/opencode.jsonc
            - Model: Gemma-4-26B (AWQ)
            - Endpoint: {{ vllm_endpoint }}/v1

          Next steps:
            1. Verify DNS resolution for {{ paperclip_domain }}
            2. Visit https://{{ paperclip_domain }} to access Paperclip
            3. OpenCode should auto-initialize with vLLM at {{ vllm_endpoint }}
            4. Run day1_deploy_hermes_docker.yml (publishes its dashboard through the same nginx)
            5. Configure agents and skills