---
# Install and configure Syncthing

- name: Install required packages
  apt:
    name:
      - apt-transport-https
      - curl
      - gnupg2
    state: present
    update_cache: yes

- name: Add Syncthing GPG key
  ansible.builtin.get_url:
    url: "https://syncthing.net/release-key.gpg"
    dest: /usr/share/keyrings/syncthing-archive-keyring.gpg
    mode: '0644'

- name: Add Syncthing repository
  ansible.builtin.deb822_repository:
    name: syncthing
    types: deb
    uris: https://apt.syncthing.net/
    suites: syncthing
    components: stable
    signed_by: /usr/share/keyrings/syncthing-archive-keyring.gpg
    state: present

- name: Install Syncthing
  apt:
    name: syncthing
    state: present
    update_cache: yes

- name: Ensure graham user exists
  user:
    name: graham
    state: present

- name: Create Syncthing configuration directory
  file:
    path: /home/graham/.config/syncthing
    state: directory
    owner: graham
    group: graham
    mode: '0755'

- name: Deploy Syncthing configuration
  template:
    src: config.xml.j2
    dest: /home/graham/.config/syncthing/config.xml
    owner: graham
    group: graham
    mode: '0600'
    backup: yes
  notify: restart syncthing

- name: Create Syncthing systemd service
  copy:
    content: |
      [Unit]
      Description=Syncthing - Open Source Continuous File Synchronization
      Documentation=man:syncthing(1)
      After=network.target

      [Service]
      Type=simple
      User=graham
      ExecStart=/usr/bin/syncthing serve --no-browser --no-restart --logflags=0
      Restart=on-failure
      RestartSec=5
      SuccessExitStatus=3 4
      RestartForceExitStatus=3 4

      # Hardening
      SystemCallArchitectures=native
      MemoryDenyWriteExecute=true
      NoNewPrivileges=true

      [Install]
      WantedBy=multi-user.target
    dest: /etc/systemd/system/syncthing@graham.service
    owner: root
    group: root
    mode: '0644'
  notify: restart syncthing

- name: Stop old syncthing service if exists
  systemd:
    name: syncthing@syncthing
    state: stopped
    enabled: no
  failed_when: false

- name: Enable and start Syncthing service
  systemd:
    name: syncthing@graham
    enabled: yes
    state: started
    daemon_reload: yes

- name: Check if ufw is installed
  command: which ufw
  register: ufw_check
  changed_when: false
  failed_when: false

- name: Configure firewall for Syncthing web UI
  ufw:
    rule: allow
    port: '8384'
    proto: tcp
    comment: 'Syncthing Web UI'
  when: 
    - ansible_facts['os_family'] == "Debian"
    - ufw_check.rc == 0

- name: Configure firewall for Syncthing sync protocol
  ufw:
    rule: allow
    port: '22000'
    proto: tcp
    comment: 'Syncthing Sync Protocol'
  when: 
    - ansible_facts['os_family'] == "Debian"
    - ufw_check.rc == 0

- name: Configure firewall for Syncthing discovery
  ufw:
    rule: allow
    port: '21027'
    proto: udp
    comment: 'Syncthing Local Discovery'
  when: 
    - ansible_facts['os_family'] == "Debian"
    - ufw_check.rc == 0