---
# Generate a per-host PSK on the Ansible controller and deploy it to the agent.
# The PSK is persisted under monitoring_zabbix_psk_store so that re-runs keep
# the same secret and the Zabbix server registration stays in sync.

- name: Ensure PSK store directory exists on controller
  ansible.builtin.file:
    path: "{{ monitoring_zabbix_psk_store }}"
    state: directory
    mode: "{{ monitoring_zabbix_psk_store_mode }}"
  delegate_to: localhost
  become: false
  run_once: false

- name: Show PSK store path
  ansible.builtin.debug:
    msg: "Persisting PSKs on the controller in {{ monitoring_zabbix_psk_store }}"
  delegate_to: localhost
  become: false
  changed_when: false

- name: Check whether PSK already exists on controller
  ansible.builtin.stat:
    path: "{{ monitoring_zabbix_psk_store }}/{{ inventory_hostname }}.psk"
  delegate_to: localhost
  become: false
  register: monitoring_psk_existing

- name: Generate per-host PSK when missing
  ansible.builtin.shell: |
    umask 077
    openssl rand -hex {{ (monitoring_zabbix_psk_bits / 8) | int }} \
      > "{{ monitoring_zabbix_psk_store }}/{{ inventory_hostname }}.psk"
  args:
    creates: "{{ monitoring_zabbix_psk_store }}/{{ inventory_hostname }}.psk"
  delegate_to: localhost
  become: false
  register: monitoring_psk_generated

- name: Slurp PSK from controller
  ansible.builtin.set_fact:
    monitoring_zabbix_psk_value: >-
      {{ lookup('ansible.builtin.file',
                monitoring_zabbix_psk_store ~ '/' ~ inventory_hostname ~ '.psk')
         | trim }}

- name: Validate PSK format
  ansible.builtin.assert:
    that:
      - monitoring_zabbix_psk_value is match('^[0-9a-fA-F]+$')
      - monitoring_zabbix_psk_value | length == (monitoring_zabbix_psk_bits / 4) | int
    fail_msg: >-
      The PSK must contain exactly {{ (monitoring_zabbix_psk_bits / 4) | int }}
      hexadecimal characters.
  delegate_to: localhost
  become: false

- name: Ensure Zabbix agent runtime directory exists
  ansible.builtin.file:
    path: "{{ monitoring_zabbix_psk_file | dirname | default('/etc/zabbix') }}"
    state: directory
    owner: root
    group: "{{ monitoring_zabbix_agent_user }}"
    mode: '0750'

- name: Deploy PSK file to agent host
  ansible.builtin.copy:
    content: "{{ monitoring_zabbix_psk_value }}\n"
    dest: "{{ monitoring_zabbix_psk_file }}"
    owner: "{{ monitoring_zabbix_agent_user }}"
    group: "{{ monitoring_zabbix_agent_user }}"
    mode: '0600'
  notify: Restart Zabbix Agent