---
- name: Check rsyslog configuration drift
  hosts: rsyslog_servers
  gather_facts: false

  # NOTE: src paths below resolve relative to the Ansible controller (the
  # Woodpecker CI container), so they always reflect the latest Git commit –
  # NOT the server's local clone, which may be stale.

  tasks:
    # -------------------------------------------------------------------------
    # Use Ansible copy in check_mode so it compares controller files (Git)
    # against live server files without actually writing anything.
    # changed=true  → file differs → drift
    # changed=false → files match  → synced
    # -------------------------------------------------------------------------
    - name: Check main rsyslog.conf
      ansible.builtin.copy:
        src: "{{ playbook_dir }}/../../files/rsyslog.conf"
        dest: "{{ rsyslog_main_config }}"
        owner: root
        group: root
        mode: '0644'
      check_mode: true
      diff: true
      register: main_config_check

    - name: Check rsyslog.d config files
      ansible.builtin.copy:
        src: "{{ playbook_dir }}/../../files/rsyslog.d/"
        dest: "{{ rsyslog_config_dir }}/"
        owner: root
        group: root
        mode: '0644'
      check_mode: true
      diff: true
      register: rsyslogd_check

    - name: Check for extra files on server not present in Git
      block:
        - name: Find config files on server
          ansible.builtin.find:
            paths: "{{ rsyslog_config_dir }}"
            patterns: "*.conf"
          register: server_configs

        - name: Find config files in Git (controller)
          ansible.builtin.find:
            paths: "{{ playbook_dir }}/../../files/rsyslog.d"
            patterns: "*.conf"
          delegate_to: localhost
          register: repo_configs

        - name: Build list of Git-managed filenames
          ansible.builtin.set_fact:
            git_filenames: "{{ repo_configs.files | map(attribute='path') | map('basename') | list }}"

        - name: Build list of server filenames
          ansible.builtin.set_fact:
            server_filenames: "{{ server_configs.files | map(attribute='path') | map('basename') | list }}"

        - name: Find server files that are managed by Git but missing on server
          ansible.builtin.set_fact:
            missing_on_server: "{{ git_filenames | difference(server_filenames) }}"

        - name: Flag if any Git-managed file is missing from server
          ansible.builtin.set_fact:
            extra_files_on_server: true
          when: missing_on_server | length > 0

        - name: Show missing files
          ansible.builtin.debug:
            msg: "Files in Git but missing on server: {{ missing_on_server }}"
          when: missing_on_server | length > 0

    - name: Set overall drift flag
      ansible.builtin.set_fact:
        drift_detected: "{{ main_config_check.changed or rsyslogd_check.changed or (extra_files_on_server | default(false)) }}"

    - name: Print SYNCED status
      ansible.builtin.debug:
        msg: |
          ╭─────────────────────────────╮
          │  ✓ SYNCED                   │
          │  Configuration is up-to-date │
          ╰─────────────────────────────╯
      when: not drift_detected

    - name: Print OUT OF SYNC status
      ansible.builtin.debug:
        msg: |
          ╭─────────────────────────────╮
          │  ✗ OUT OF SYNC              │
          │  Configuration has drifted   │
          ╰─────────────────────────────╯
      when: drift_detected

    - name: Fail if drift detected
      ansible.builtin.fail:
        msg: "Configuration drift detected. Live system does not match repository."
      when: drift_detected