# Homepage recategorisation — ana-docker (10.250.50.70), 13 containers.
#
# Splits the dashboard on ONE axis: do you open this thing, or is it an
# endpoint you only want to know is alive? See the layout: block in
# stacks/homepage/conf/settings.yaml for the target shape.
#
#   memos, miniflux, nevermore, searxng  ->  Daily          (was Notes / News / Apps)
#   zed-fim-proxy                        ->  AI - Inference (no UI; href is /ping)
#   adguardhome                          ->  DNS & Filtering
#   traefik                              ->  Reverse Proxies
#   dockge                               ->  Compose Consoles
#   crowdsec, mailrise, rest-server,
#   gitea-runner, hbbr (RustDesk relay)  ->  Agents (no UI)
#
# `homepage.group` is read at container CREATION, so each edit is followed by
# `compose up -d <service>` — a restart would leave the old label in place.
# Both halves are idempotent: the sed is gated on the old value still being
# present, and `up -d` is a no-op when the container already matches its spec.
#
# Run:  scripts/elway infra-ops@10.250.50.70 --playbook playbooks/homepage-regroup-ana-docker.yaml

steps:
  # ---- label edits -------------------------------------------------------
  - name: memos -> Daily
    sudo: true
    shell: >-
      sed -i 's|homepage.group=Notes$|homepage.group=Daily|'
      /opt/docker/compose/memos/compose.yaml
    when: grep -q 'homepage.group=Notes$' /opt/docker/compose/memos/compose.yaml

  - name: miniflux -> Daily
    sudo: true
    shell: >-
      sed -i 's|homepage.group=News$|homepage.group=Daily|'
      /opt/docker/compose/miniflux/compose.yaml
    when: grep -q 'homepage.group=News$' /opt/docker/compose/miniflux/compose.yaml

  - name: nevermore -> Daily
    sudo: true
    shell: >-
      sed -i 's|homepage.group=News$|homepage.group=Daily|'
      /opt/docker/compose/nevermore/compose.yaml
    when: grep -q 'homepage.group=News$' /opt/docker/compose/nevermore/compose.yaml

  - name: searxng -> Daily
    sudo: true
    shell: >-
      sed -i 's|homepage.group=Apps$|homepage.group=Daily|'
      /opt/docker/compose/searxng/compose.yaml
    when: grep -q 'homepage.group=Apps$' /opt/docker/compose/searxng/compose.yaml

  - name: zed-fim-proxy -> AI - Inference
    sudo: true
    shell: >-
      sed -i 's|homepage.group=AI - Gateways . Chat$|homepage.group=AI - Inference|'
      /opt/docker/compose/zed-fim-proxy/compose.yaml
    when: grep -q 'homepage.group=AI - Gateways . Chat$' /opt/docker/compose/zed-fim-proxy/compose.yaml

  - name: adguardhome -> DNS & Filtering
    sudo: true
    shell: >-
      sed -i 's|homepage.group=Service Networking$|homepage.group=DNS \& Filtering|'
      /opt/docker/compose/adguard-ana/compose.yaml
    when: grep -q 'homepage.group=Service Networking$' /opt/docker/compose/adguard-ana/compose.yaml

  - name: traefik -> Reverse Proxies
    sudo: true
    shell: >-
      sed -i 's|homepage.group=Service Networking$|homepage.group=Reverse Proxies|'
      /opt/docker/compose/traefik/compose.yaml
    when: grep -q 'homepage.group=Service Networking$' /opt/docker/compose/traefik/compose.yaml

  - name: dockge -> Compose Consoles
    sudo: true
    shell: >-
      sed -i 's|homepage.group=Service Networking$|homepage.group=Compose Consoles|'
      /opt/docker/compose/dockge/compose.yaml
    when: grep -q 'homepage.group=Service Networking$' /opt/docker/compose/dockge/compose.yaml

  - name: crowdsec -> Agents (no UI)
    sudo: true
    shell: >-
      sed -i 's|homepage.group=Service Networking$|homepage.group=Agents (no UI)|'
      /opt/docker/compose/crowdsec/compose.yaml
    when: grep -q 'homepage.group=Service Networking$' /opt/docker/compose/crowdsec/compose.yaml

  - name: mailrise -> Agents (no UI)
    sudo: true
    shell: >-
      sed -i 's|homepage.group=Service Networking$|homepage.group=Agents (no UI)|'
      /opt/docker/compose/mailrise/compose.yaml
    when: grep -q 'homepage.group=Service Networking$' /opt/docker/compose/mailrise/compose.yaml

  - name: rest-server -> Agents (no UI)
    sudo: true
    shell: >-
      sed -i 's|homepage.group=Service Networking$|homepage.group=Agents (no UI)|'
      /opt/docker/compose/rest-server-ana/compose.yaml
    when: grep -q 'homepage.group=Service Networking$' /opt/docker/compose/rest-server-ana/compose.yaml

  - name: gitea-runner -> Agents (no UI)
    sudo: true
    shell: >-
      sed -i 's|homepage.group=Toolchain$|homepage.group=Agents (no UI)|'
      /opt/docker/compose/gitea-runner/compose.yaml
    when: grep -q 'homepage.group=Toolchain$' /opt/docker/compose/gitea-runner/compose.yaml

  - name: rustdesk (hbbr) -> Agents (no UI)
    sudo: true
    shell: >-
      sed -i 's|homepage.group=Apps$|homepage.group=Agents (no UI)|'
      /opt/docker/compose/rustdesk/compose.yaml
    when: grep -q 'homepage.group=Apps$' /opt/docker/compose/rustdesk/compose.yaml

  # Two containers were both named plain "Open WebUI" and, once the ESH one
  # joined this group, they landed side by side — same name, same icon family,
  # only the description telling them apart. Site suffix, like Traefik/Dockge/
  # AdGuard already carry.
  - name: openwebui (ana) -> "Open WebUI (ana)"
    sudo: true
    shell: >-
      sed -i 's|homepage.name=Open WebUI$|homepage.name=Open WebUI (ana)|'
      /opt/docker/compose/openwebui/compose.yaml
    when: grep -q 'homepage.name=Open WebUI$' /opt/docker/compose/openwebui/compose.yaml

  # ---- recreates ---------------------------------------------------------
  # traefik goes LAST: crowdsec is its bouncer, so bounce the bouncer first
  # and let traefik come up against a settled agent.
  - name: recreate memos
    sudo: true
    shell: cd /opt/docker/compose/memos && docker compose up -d memos

  - name: recreate miniflux
    sudo: true
    shell: cd /opt/docker/compose/miniflux && docker compose up -d miniflux

  - name: recreate nevermore-web
    sudo: true
    shell: cd /opt/docker/compose/nevermore && docker compose up -d nevermore-web

  - name: recreate searxng
    sudo: true
    shell: cd /opt/docker/compose/searxng && docker compose up -d searxng

  - name: recreate zed-fim-proxy
    sudo: true
    shell: cd /opt/docker/compose/zed-fim-proxy && docker compose up -d zed-fim-proxy

  - name: recreate mailrise
    sudo: true
    shell: cd /opt/docker/compose/mailrise && docker compose up -d mailrise

  - name: recreate rest-server
    sudo: true
    shell: cd /opt/docker/compose/rest-server-ana && docker compose up -d rest-server

  - name: recreate gitea-runner
    sudo: true
    shell: cd /opt/docker/compose/gitea-runner && docker compose up -d runner

  - name: recreate rustdesk relay
    sudo: true
    shell: cd /opt/docker/compose/rustdesk && docker compose up -d hbbr

  - name: recreate openwebui (ana)
    sudo: true
    shell: cd /opt/docker/compose/openwebui && docker compose up -d open-webui

  - name: recreate dockge
    sudo: true
    shell: cd /opt/docker/compose/dockge && docker compose up -d dockge

  - name: recreate adguardhome
    sudo: true
    shell: cd /opt/docker/compose/adguard-ana && docker compose up -d adguardhome

  - name: recreate crowdsec
    sudo: true
    shell: cd /opt/docker/compose/crowdsec && docker compose up -d crowdsec

  - name: recreate traefik
    sudo: true
    shell: cd /opt/docker/compose/traefik && docker compose up -d traefik

verify:
  - name: every relabelled container now carries its new group
    sudo: true
    changed_when: "false"
    shell: >-
      docker inspect -f '{{.Name}} {{index .Config.Labels "homepage.group"}}'
      memos miniflux nevermore-web searxng zed-fim-proxy adguardhome traefik
      dockge crowdsec mailrise rest-server gitea-runner hbbr

  - name: no container is left in the retired Service Networking group
    sudo: true
    changed_when: "false"
    shell: >-
      test -z "$(docker ps -q --filter 'label=homepage.group=Service Networking')"

  # dig is not installed everywhere in the fleet, so fall back to the AdGuard
  # UI — a resolver that serves its own dashboard on :8053 has come back up.
  - name: adguard is back (DNS answer, or its UI if dig is absent)
    changed_when: "false"
    shell: >-
      if command -v dig >/dev/null 2>&1;
      then dig +short +time=3 +tries=2 @10.250.50.70 gitea.phasefinal.com | grep -q .;
      else curl -sf -o /dev/null -m 8 http://10.250.50.70:8053/; fi

  # Retried, not one-shot: the first run of this playbook checked 0.12s after
  # `Started` and got rc=7 while traefik was still binding. The container was
  # fine — `:8380/` 301s to /dashboard/ and both public hostnames answered 200
  # seconds later. A recreate needs a moment; assert the settled state.
  - name: traefik still routes
    changed_when: "false"
    shell: >-
      for i in 1 2 3 4 5 6 7 8 9 10; do
      curl -sfL -o /dev/null -m 5 http://127.0.0.1:8380/dashboard/ && exit 0;
      sleep 3; done; exit 1

  - name: everything is running
    sudo: true
    changed_when: "false"
    shell: >-
      test "$(docker inspect -f '{{.State.Running}}' memos miniflux nevermore-web
      searxng zed-fim-proxy adguardhome traefik dockge crowdsec mailrise
      rest-server gitea-runner hbbr | sort -u)" = "true"