---
- name: Install Docker
  become: true
  block:
    - name: Install Docker prerequisites
      ansible.builtin.apt:
        name:
          - ca-certificates
          - curl
          - python3-debian ## needed for the deb822 module
        state: present
        update_cache: true

    - name: Add Docker official APT repository (DEB822 format)
      ansible.builtin.deb822_repository:
        name: docker
        types: deb
        uris: "https://download.docker.com/linux/{{ ansible_facts['distribution'] | lower }}"
        suites: "{{ ansible_facts['distribution_release'] }}"
        components: stable
        signed_by: "https://download.docker.com/linux/{{ ansible_facts['distribution'] | lower }}/gpg"
        state: present

    - name: Install Docker CE packages
      ansible.builtin.apt:
        name:
          - docker-ce
          - docker-ce-cli
          - containerd.io
          - docker-buildx-plugin
          - docker-compose-plugin
        state: present
        update_cache: true

    - name: Ensure Docker service is running and enabled
      ansible.builtin.service:
        name: docker
        state: started
        enabled: true

- name: Configure deployment user for Docker
  when: deployment_public_ssh_key is defined
  become: true
  block:
    - name: Add deployment user to docker group
      ansible.builtin.user:
        name: deployment
        groups: docker
        append: true

    - name: Create target for docker compose
      ansible.builtin.file:
        path: /opt/docker
        state: directory
        owner: deployment
        group: deployment
        mode: "0755"

- name: Create app user for secure container execution
  become: true
  block:
    - name: Create appuser group
      ansible.builtin.group:
        name: appuser
        state: present
        gid: 9999

    - name: Create appuser
      ansible.builtin.user:
        name: appuser
        state: present
        uid: 9999
        group: appuser
        system: true
        shell: /usr/sbin/nologin
        create_home: false