---
- name: Ensure EJBCA VM exists on Proxmox
  hosts: front
  gather_facts: no
  connection: local

  vars:
    api_user: "root@pam!ansible"
    api_token_id: "ansible"                                      # Name des Tokens in PVE
    api_token_secret: "f77b7f8c-8c73-4782-a4ad-8bbf7162e7ca"     # Secret aus PVE
    api_host: "{{ ansible_host }}"
    node: "fhs0"                                                  # exakter Node-Name in Proxmox
    vmid: 250
    vm_name: "ca-heim"
    memory: 4096
    cores: 2
    scsi_storage: "CEPH_SSD"                                      # VM-Disk Speicher
    scsi_size: 20
    bridge: "DMZ"
    iso_image: "debian-13.2.0-amd64-DVD.iso"                     # ISO auf CEPH-Share
    start_vm: false

  tasks:
    - name: Ensure old VM is absent (idempotent)
      community.proxmox.proxmox_kvm:
        api_user: "{{ api_user }}"
        api_token_id: "{{ api_token_id }}"
        api_token_secret: "{{ api_token_secret }}"
        api_host: "{{ api_host }}"
        node: "{{ node }}"
        vmid: "{{ vmid }}"
        state: absent
        force: yes
        validate_certs: false

    - name: Create VM without starting
      community.proxmox.proxmox_kvm:
        api_user: "{{ api_user }}"
        api_token_id: "{{ api_token_id }}"
        api_token_secret: "{{ api_token_secret }}"
        api_host: "{{ api_host }}"
        node: "{{ node }}"
        vmid: "{{ vmid }}"
        name: "{{ vm_name }}"
        memory: "{{ memory }}"
        cores: "{{ cores }}"
        net0: "virtio,bridge={{ bridge }}"
        scsi0: "{{ scsi_storage }}:vm-{{ vmid }}-disk-0,size={{ scsi_size }}G,format=qcow2,pool={{ scsi_storage }}"
        ide2: "CEPH-Share:iso/{{ iso_image }},media=cdrom"
        boot: "cdn"
        ostype: l26
        state: present
        validate_certs: false

    - name: Optionally start VM
      community.proxmox.proxmox_kvm:
        api_user: "{{ api_user }}"
        api_token_id: "{{ api_token_id }}"
        api_token_secret: "{{ api_token_secret }}"
        api_host: "{{ api_host }}"
        node: "{{ node }}"
        vmid: "{{ vmid }}"
        state: started
        wait: yes
        timeout: 300
        validate_certs: false
      when: start_vm

    - name: VM Info
      debug:
        msg: "VM '{{ vm_name }}' (ID {{ vmid }}) is ready. Disk on {{ scsi_storage }}, ISO on CEPH-Share"