#!/usr/bin/env bash
set -Eeuo pipefail

# ------------------------------------------------------------
# Ansible Rocky production patching wrapper
# Intended to be run by systemd service/timer
# ------------------------------------------------------------

ANSIBLE_PROJECT="/opt/Ansible"
VENV_PATH="${ANSIBLE_PROJECT}/.venv"

PLAYBOOK="${ANSIBLE_PROJECT}/playbooks/update-rocky-prod.yml"
LOCK_FILE="/tmp/update-rocky-prod.lock"

ANSIBLE_PLAYBOOK="${VENV_PATH}/bin/ansible-playbook"

log() {
    echo "[$(date '+%Y-%m-%d %H:%M:%S')] $*"
}

fail() {
    log "ERROR: $*"
    exit 1
}

log "Starting Rocky production patching"

[[ -d "$VENV_PATH" ]] || fail "Python virtual environment not found: $VENV_PATH"
[[ -x "$ANSIBLE_PLAYBOOK" ]] || fail "ansible-playbook not found or not executable: $ANSIBLE_PLAYBOOK"
[[ -f "$PLAYBOOK" ]] || fail "Playbook not found: $PLAYBOOK"

(
    flock -n 200 || fail "Another patching run is already active"

    cd "$ANSIBLE_PROJECT"

    "$ANSIBLE_PLAYBOOK" \
        "$PLAYBOOK" 

) 200>"$LOCK_FILE"

log "Finished Rocky production patching"