---
- name: Safe Nextcloud upgrade on Rocky Linux
  hosts: all
  become: yes
  vars:
    nextcloud_dir: /var/www/nextcloud
    web_user: apache
    php_cli: /usr/bin/php
    service_name: httpd

  tasks:

    - name: Reminder - ensure backups exist
      debug:
        msg: "⚠️ Ensure you have valid DB + data directory backups before upgrade!"

    # ----------------------------------------------------------------------
    # Step 1: Check current version
    # ----------------------------------------------------------------------
    - name: Get current Nextcloud version
      command: "{{ php_cli }} occ status"
      args:
        chdir: "{{ nextcloud_dir }}"
      become_user: "{{ web_user }}"
      register: occ_status
      changed_when: false
      failed_when: occ_status.rc != 0 and "'installed: true'" not in occ_status.stdout

    - name: Parse current version
      set_fact:
        current_version: "{{ occ_status.stdout | regex_search('versionstring: (.*)', '\\1') | first | default('unknown') }}"
      when: occ_status.stdout is defined

    - name: Show current version
      debug:
        msg: "Current Nextcloud version: {{ current_version }}"

    # ----------------------------------------------------------------------
    # Step 2: Enable maintenance mode
    # ----------------------------------------------------------------------
    - name: Enable maintenance mode
      command: "{{ php_cli }} occ maintenance:mode --on"
      args:
        chdir: "{{ nextcloud_dir }}"
      become_user: "{{ web_user }}"
      environment:
        TMPDIR: /tmp

    # ----------------------------------------------------------------------
    # Step 3: Run updater safely with retry
    # ----------------------------------------------------------------------
    - name: Run Nextcloud CLI updater (non-interactive)
      block:

        - name: Execute updater (first attempt)
          command: "{{ php_cli }} updater/updater.phar --no-interaction"
          args:
            chdir: "{{ nextcloud_dir }}"
          become_user: "{{ web_user }}"
          environment:
            TMPDIR: /tmp
          register: updater_result
          failed_when: false

        - name: Detect signature verification failure
          debug:
            msg: "Signature verification failed, cleaning downloads before retry."
          when: "'Signature of update is not valid' in updater_result.stdout"

        - name: Clean failed update downloads if signature invalid
          file:
            path: "{{ nextcloud_dir }}/data"
            state: directory
          when: "'Signature of update is not valid' in updater_result.stdout"

        - name: Retry updater if signature invalid
          command: "{{ php_cli }} updater/updater.phar --no-interaction"
          args:
            chdir: "{{ nextcloud_dir }}"
          become_user: "{{ web_user }}"
          environment:
            TMPDIR: /tmp
          when: "'Signature of update is not valid' in updater_result.stdout"
          register: updater_result_retry
          failed_when: false

        - name: Check updater success
          fail:
            msg: "Nextcloud updater failed. Check updater log or rerun manually."
          when:
            - updater_result.rc != 0
            - "'Nextcloud is already latest version' not in updater_result.stdout"
            - "'Update successful' not in updater_result.stdout"
            - "'Update successful' not in (updater_result_retry.stdout | default(''))"

    # ----------------------------------------------------------------------
    # Step 4: Run database upgrade + cleanup
    # ----------------------------------------------------------------------
    - name: Run occ upgrade
      command: "{{ php_cli }} occ upgrade"
      args:
        chdir: "{{ nextcloud_dir }}"
      become_user: "{{ web_user }}"
      environment:
        TMPDIR: /tmp

    - name: Add missing indices (optional)
      command: "{{ php_cli }} occ db:add-missing-indices"
      args:
        chdir: "{{ nextcloud_dir }}"
      become_user: "{{ web_user }}"
      environment:
        TMPDIR: /tmp
      ignore_errors: yes

    - name: Convert filecache bigint fields (optional)
      command: "{{ php_cli }} occ db:convert-filecache-bigint --no-interaction"
      args:
        chdir: "{{ nextcloud_dir }}"
      become_user: "{{ web_user }}"
      environment:
        TMPDIR: /tmp
      ignore_errors: yes

    # ----------------------------------------------------------------------
    # Step 5: Disable maintenance mode
    # ----------------------------------------------------------------------
    - name: Disable maintenance mode
      command: "{{ php_cli }} occ maintenance:mode --off"
      args:
        chdir: "{{ nextcloud_dir }}"
      become_user: "{{ web_user }}"
      environment:
        TMPDIR: /tmp
      ignore_errors: yes

    # ----------------------------------------------------------------------
    # Step 6: Restart web service
    # ----------------------------------------------------------------------
    - name: Restart Apache httpd
      service:
        name: "{{ service_name }}"
        state: restarted

    # ----------------------------------------------------------------------
    # Step 7: Verify upgrade result
    # ----------------------------------------------------------------------
    - name: Check new Nextcloud version
      command: "{{ php_cli }} occ status"
      args:
        chdir: "{{ nextcloud_dir }}"
      become_user: "{{ web_user }}"
      environment:
        TMPDIR: /tmp
      register: occ_status_after

    - name: Display new version info
      debug:
        var: occ_status_after.stdout