---
- name: Create tailscale preauthkey secret for {{ _service_tailscale_container_name }}
  when:
    - not ansible_check_mode
    - "_service_tailscale_container_name ~ '-tailscale-preauthkey' not in service_podman_secrets"
  block:
    - name: Get preauthkey from tailscale API
      ansible.builtin.uri:
        url: "{{ service_tailscale_login_server }}/api/v1/preauthkey"
        headers:
          Authorization: Bearer {{ service_tailscale_apikey }}
        method: POST
        body:
          expiration: >-
            {{
              now(utc=true).replace(
                day=now(utc=true).day if now(utc=true).hour != 23 else now(utc=true).day + 1,
                hour=now(utc=true).hour + 1 if now(utc=true).hour != 23 else 0
              ).isoformat()
            }}Z
          aclTags:
            - tag:container
            - "tag:{{ _service_tailscale_container_name }}"
        body_format: json
      register: _service_tailscale_preauthkey
    - name: Create preauthkey secret
      containers.podman.podman_secret:
        name: "{{ _service_tailscale_container_name }}-tailscale-preauthkey"
        data: "{{ _service_tailscale_preauthkey.json.preAuthKey.key }}"
      no_log: true

- name: Tailscale container for {{ _service_tailscale_container_name }}
  ansible.builtin.import_role:
    name: container
  vars:
    container_name: "{{ _service_tailscale_container_name }}-tailscale"
    container_image: docker.io/tailscale/tailscale:latest
    container_networks: "{{ _service_tailscale_networks }}"
    container_hostname: "{{ _service_tailscale_hostname }}"
    container_add_capabilities:
      - NET_ADMIN
    container_devices:
      - source: /dev/net/tun
    container_mounts:
      - type: volume
        source: "{{ _service_tailscale_container_name }}-tailscale"
        destination: /var/lib/tailscale
    container_auto_update: "{{ service_auto_update }}"
    container_secrets:
      - name: "{{ _service_tailscale_container_name }}-tailscale-preauthkey"
        target: preauthkey
    container_env:
      TS_STATE_DIR: /var/lib/tailscale
      TS_AUTHKEY: file:/run/secrets/preauthkey
      TS_EXTRA_ARGS: --login-server={{ service_tailscale_login_server }}
      TS_HOSTNAME: "{{ _service_tailscale_container_name }}"
      TS_AUTH_ONCE: "true"
      TS_NO_LOGS_NO_SUPPORT: "true"
      TS_USERSPACE: "false"
      TS_ACCEPT_DNS: "true"