---
- name: Развертывание Unprivileged LXC (Финал)
  hosts: localhost
  connection: local
  become: yes
  gather_facts: no
  vars:
    # Конфиг уже включает ID Mapping
    base_conf: |
      lxc.include = /usr/share/lxc/config/common.conf
      lxc.include = /usr/share/lxc/config/debian.common.conf
      lxc.arch = x86_64
      lxc.idmap = u 0 100000 65536
      lxc.idmap = g 0 100000 65536
      lxc.net.0.type = veth
      lxc.net.0.link = br0
      lxc.net.0.flags = up
      lxc.net.0.name = eth0

  tasks:
    - name: 1. Очистка старых контейнеров
      shell: |
        lxc-stop -n {{ item }} -k || true
        lxc-destroy -n {{ item }} || true
        zfs destroy -r pool/lxc/{{ item }} || true
      loop: [ 'bit-srv-prn', 'mail-bit-it-ru' ]
      failed_when: false

    - name: 2. Мгновенный клон ZFS (уже с правами 100000)
      shell: "zfs clone pool/lxc/template-debian12@snap0 pool/lxc/{{ item }}"
      loop: [ 'bit-srv-prn', 'mail-bit-it-ru' ]

    - name: 3. Установка legacy mountpoint
      shell: "zfs set mountpoint=legacy pool/lxc/{{ item }}"
      loop: [ 'bit-srv-prn', 'mail-bit-it-ru' ]

    - name: 4. Подготовка папок LXC
      file:
        path: "/var/lib/lxc/{{ item }}"
        state: directory
      

loop: [ 'bit-srv-prn', 'mail-bit-it-ru' ]

    - name: 5. Права на внешние данные (для почты)
      file:
        path: /pool/bit-mail-data
        owner: "100000"
        group: "100000"
        recurse: yes

    - name: 6. Запись конфигов
      copy:
        dest: "/var/lib/lxc/{{ item.name }}/config"
        content: |
          {{ base_conf }}
          lxc.net.0.veth.vlan.id = {{ item.vlan }}
          lxc.rootfs.path = zfs:pool/lxc/{{ item.name }}
          lxc.uts.name = {{ item.name }}
          {% if item.mount is defined %}{{ item.mount }}{% endif %}
      loop:
        - { name: 'bit-srv-prn', vlan: '30' }
        - { name: 'mail-bit-it-ru', vlan: '60', mount: 'lxc.mount.entry = /pool/bit-mail-data var/mail none bind,create=dir 0 0' }

    - name: 7. Запуск
      shell: "lxc-start -n {{ item.name }} -d"
      loop:
        - { name: 'bit-srv-prn' }
        - { name: 'mail-bit-it-ru' }