---
- name: SOPS + Age Key Deployment
  hosts: all
  become: yes
  tasks:
    - name: sops installieren
      ansible.builtin.shell: |
        if ! command -v sops &>/dev/null; then
          curl -sLo /usr/local/bin/sops https://github.com/getsops/sops/releases/download/v3.12.2/sops-v3.12.2.linux.amd64
          chmod +x /usr/local/bin/sops
        fi
      args:
        creates: /usr/local/bin/sops

    - name: Age Key Verzeichnis erstellen
      ansible.builtin.file:
        path: /root/.config/sops/age
        state: directory
        mode: "0700"

    - name: Age Key deployen
      ansible.builtin.copy:
        content: |
          # created: 2026-04-04T09:42:26+02:00
          # public key: age1z8gak2l4h0vpcnhtcdxmem2u9h2n54vuksk8ys82609qtzampuvqh50wdr
          AGE-SECRET-KEY-19RPRZ89VNDR6KECR7ULA38P8KJ7FHMXJ9N07UUJHLGSVMUW69LHS89XDD2
        dest: /root/.config/sops/age/keys.txt
        mode: "0600"

    - name: sops decrypt Hook fuer Git-Repos erstellen
      ansible.builtin.copy:
        content: |
          #!/bin/bash
          # Post-merge hook: decrypt .env.enc after git pull
          if [ -f .env.enc ]; then
            sops -d --input-type dotenv --output-type dotenv .env.enc > .env
            echo "[sops] .env decrypted"
          fi
        dest: /usr/local/bin/sops-decrypt-env
        mode: "0755"