---
- name: Bootstrap new host - Setup sudo
  hosts: all
  tags: bootstrap
  remote_user: graham
  gather_facts: false
  vars:
    ansible_user: graham
  tasks:
    # Probe before attempting privilege escalation. If sudo already works for
    # graham, the install-via-su tasks below would otherwise block on a root
    # password prompt that the Makefile's `-K` is designed to feed — and on a
    # passwordless-sudo host with no `-K` provided, hang indefinitely.
    - name: Probe sudo state
      ansible.builtin.raw: |
        if command -v sudo >/dev/null 2>&1; then
          if sudo -n true 2>/dev/null; then
            echo "sudo-passwordless"
          else
            echo "sudo-needs-password"
          fi
        else
          echo "sudo-missing"
        fi
      register: sudo_state
      changed_when: false

    - name: Ensure sudo is present
      ansible.builtin.raw: |
        if command -v apt-get >/dev/null 2>&1; then
          apt-get update && apt-get install -y sudo
        elif command -v dnf >/dev/null 2>&1; then
          dnf install -y sudo
        elif command -v yum >/dev/null 2>&1; then
          yum install -y sudo
        elif command -v apk >/dev/null 2>&1; then
          apk add --no-cache sudo
        elif command -v pkg >/dev/null 2>&1; then
          pkg bootstrap -y && pkg install -y sudo
        else
          echo "Unsupported package manager for sudo installation" >&2
          exit 1
        fi
      become: true
      become_method: su
      become_user: root
      when: "'sudo-missing' in sudo_state.stdout"

    - name: Ensure Python 3 is present
      ansible.builtin.raw: |
        if command -v python3 >/dev/null 2>&1; then
          exit 0
        fi
        if command -v apt-get >/dev/null 2>&1; then
          apt-get update && apt-get install -y python3 python3-apt
        elif command -v dnf >/dev/null 2>&1; then
          dnf install -y python3
        elif command -v yum >/dev/null 2>&1; then
          yum install -y python3
        elif command -v apk >/dev/null 2>&1; then
          apk add --no-cache python3 py3-pip
        elif command -v pkg >/dev/null 2>&1; then
          pkg install -y python3
        else
          echo "Unsupported package manager for python3 installation" >&2
          exit 1
        fi
      changed_when: false
      become: true
      # Once sudo exists (newly installed or pre-existing) prefer it; only fall
      # back to `su` if sudo really isn't there.
      become_method: "{{ 'su' if 'sudo-missing' in sudo_state.stdout else 'sudo' }}"
      become_user: root

- name: Bootstrap new host - Base configuration
  hosts: all
  tags: bootstrap
  remote_user: graham
  become: true
  become_method: sudo  # Requires -K if graham needs a sudo password (see bootstrap-init target)
  vars:
    ansible_user: graham
    ansible_python_interpreter: /usr/bin/python3
  roles:
    - base