---
# Restart the RustDesk remote-access service.
# Run: ansible-playbook -i inventory/hosts.yml playbooks/bf-rustdesk-restart.yml -e operation_wave=lab -e operation_confirmed=true --limit lab
# Service name is overridable via rustdesk_service_name.
# No Semaphore Pro feature is used.
- name: Restart RustDesk service
  hosts: "{{ operation_wave | default('invalid-wave', true) }}"
  gather_facts: false
  become: true
  vars:
    approved_operation_waves: [lab, pilot_1, pilot_2, wave_1, wave_2, production]
    production_override: false
    rustdesk_restart_service: "{{ rustdesk_service_name | default('rustdesk') }}"
  pre_tasks:
    - name: Require confirmed approved operation wave scope
      ansible.builtin.assert:
        that:
          - operation_wave in approved_operation_waves
          - operation_confirmed | bool
          - operation_wave in groups
          - ansible_play_hosts_all | length > 0
          - ansible_play_hosts_all | difference(groups[operation_wave]) | length == 0
        fail_msg: "Set operation_wave to one inventory wave and operation_confirmed=true; full-fleet scope is refused."
      run_once: true

    - name: Require separate production override
      ansible.builtin.assert:
        that:
          - operation_wave != 'production' or production_override | bool
        fail_msg: "Production operation requires production_override=true in addition to operation_confirmed=true."
      run_once: true
  tasks:
    - name: Restart RustDesk
      ansible.builtin.systemd:
        name: "{{ rustdesk_restart_service }}"
        state: restarted

    - name: Verify RustDesk is active
      ansible.builtin.command:
        argv: [systemctl, is-active, "{{ rustdesk_restart_service }}"]
      register: rustdesk_state
      changed_when: false

    - name: Show RustDesk state
      ansible.builtin.debug:
        msg: "{{ inventory_hostname }} rustdesk={{ rustdesk_state.stdout }}"