---
# decommission.yml — Runs before Aether deletes an instance
#
# Aether passes the same extra vars as post-deploy:
#   vm_name, vm_ip, environment, owner, cost_center
#
# This playbook runs best-effort: failures do NOT block instance
# deletion in Aether. The playbook should be defensive and handle
# unreachable hosts gracefully.

- name: Decommission — prepare instance for deletion
  hosts: localhost
  gather_facts: false
  connection: local

  vars:
    vm_name: "{{ vm_name | default('unknown') }}"
    vm_ip: "{{ vm_ip | default('') }}"
    environment_name: "{{ environment | default('lab') }}"
    owner: "{{ owner | default('unassigned') }}"
    cost_center: "{{ cost_center | default('') }}"
    ssh_user: root

  tasks:
    - name: Add target host to in-memory inventory
      ansible.builtin.add_host:
        name: "{{ vm_ip }}"
        groups: target
        ansible_user: "{{ ssh_user }}"
        ansible_host: "{{ vm_ip }}"
      when: vm_ip | length > 0

- name: Attempt graceful shutdown on target
  hosts: target
  gather_facts: false
  ignore_unreachable: true

  tasks:
    - name: Check if host is reachable
      ansible.builtin.wait_for_connection:
        delay: 0
        timeout: 15
      register: host_check
      ignore_errors: true

    - name: Stop application services (best-effort)
      ansible.builtin.shell: |
        # Stop user-facing services before deletion
        systemctl list-units --type=service --state=running --no-legend \
          | awk '{print $1}' \
          | grep -vE '^(ssh|systemd|dbus|cron|networking|rsyslog)' \
          | head -20 \
          | xargs -r -n1 systemctl stop
      register: service_stop
      ignore_errors: true
      when: host_check is succeeded

    - name: Flush logs to persistent storage
      ansible.builtin.command: journalctl --flush
      ignore_errors: true
      when: host_check is succeeded

- name: Log decommission
  hosts: localhost
  gather_facts: false
  connection: local

  tasks:
    - name: Record decommission in ledger
      ansible.builtin.lineinfile:
        path: /var/log/awx-deploy-ledger.log
        line: >-
          {{ ansible_date_time.iso8601 | default(lookup('pipe', 'date -Iseconds')) }}
          DECOMMISSION vm_name={{ vm_name }} vm_ip={{ vm_ip }}
          environment={{ environment_name }} owner={{ owner }}
          cost_center={{ cost_center }} status=completed
        create: true
        mode: "0644"