---
# runner-guardrails role
# 管理 host-level actions.runner.* services 的持久化資源護欄。

- name: "runner guardrails | 探測 runner units"
  ansible.builtin.shell: |
    set -o pipefail
    systemctl list-unit-files '{{ runner_guardrails_unit_glob }}' --no-legend --no-pager 2>/dev/null | awk '{print $1}'
  args:
    executable: /bin/bash
  register: runner_guardrails_units_raw
  changed_when: false
  failed_when: false
  tags: runner_guardrails

- name: "runner guardrails | 設定已探測到的 units"
  ansible.builtin.set_fact:
    runner_guardrails_units: "{{ runner_guardrails_units_raw.stdout_lines | default([]) }}"
  tags: runner_guardrails

- name: "runner guardrails | 找不到 runner units 時提醒"
  ansible.builtin.debug:
    msg: "這台主機找不到 {{ runner_guardrails_unit_glob }} systemd unit files。"
  when: runner_guardrails_units | length == 0
  tags: runner_guardrails

- name: "runner guardrails | 建立 drop-in 目錄"
  ansible.builtin.file:
    path: "/etc/systemd/system/{{ item }}.d"
    state: directory
    owner: root
    group: root
    mode: "0755"
  loop: "{{ runner_guardrails_units }}"
  tags: runner_guardrails

- name: "runner guardrails | 移除錯誤 watchdog drop-ins"
  ansible.builtin.file:
    path: "/etc/systemd/system/{{ item }}.d/watchdog.conf"
    state: absent
  loop: "{{ runner_guardrails_units }}"
  notify: daemon reload
  tags: runner_guardrails

- name: "runner guardrails | 安裝持久化資源 drop-ins"
  ansible.builtin.copy:
    dest: "/etc/systemd/system/{{ item }}.d/resource-guard.conf"
    owner: root
    group: root
    mode: "0644"
    content: |
      [Service]
      CPUAccounting=yes
      CPUQuota={{ runner_guardrails_cpu_quota }}
      MemoryAccounting=yes
      MemoryMax={{ runner_guardrails_memory_max }}
      WatchdogSec=0
  loop: "{{ runner_guardrails_units }}"
  notify: daemon reload
  tags: runner_guardrails

- name: "runner guardrails | runtime 動作前立即 daemon reload"
  ansible.builtin.systemd:
    daemon_reload: true
  when:
    - runner_guardrails_units | length > 0
    - runner_guardrails_apply_runtime or runner_guardrails_restart_units
  tags: runner_guardrails

- name: "runner guardrails | 不重啟套用 runtime properties"
  ansible.builtin.command:
    cmd: >-
      systemctl set-property --runtime {{ item }}
      CPUAccounting=yes CPUQuota={{ runner_guardrails_cpu_quota }}
      MemoryAccounting=yes MemoryMax={{ runner_guardrails_memory_max }}
  loop: "{{ runner_guardrails_units }}"
  changed_when: true
  when:
    - runner_guardrails_apply_runtime
    - not ansible_check_mode
  tags: runner_guardrails

- name: "runner guardrails | 明確要求時才重啟 units"
  ansible.builtin.systemd:
    name: "{{ item }}"
    state: restarted
  loop: "{{ runner_guardrails_units }}"
  when:
    - runner_guardrails_restart_units
    - not ansible_check_mode
  tags: runner_guardrails

- name: "runner guardrails | 驗證持久化設定"
  ansible.builtin.command:
    cmd: >-
      systemctl show {{ item }}
      -p CPUQuotaPerSecUSec -p MemoryMax -p WatchdogUSec
  loop: "{{ runner_guardrails_units }}"
  register: runner_guardrails_verify
  changed_when: false
  when: runner_guardrails_units | length > 0
  tags: runner_guardrails

- name: "runner guardrails | 顯示驗證結果"
  ansible.builtin.debug:
    var: runner_guardrails_verify.results
  when:
    - runner_guardrails_units | length > 0
    - runner_guardrails_verify is defined
  tags: runner_guardrails
