---
# Ships the whole journal to VictoriaLogs. The uploader keeps the cursor of the last uploaded
# entry in its state directory, so a restart resumes where it stopped.
- name: Require the endpoint and the credential
  ansible.builtin.assert:
    that:
      - journal_upload.host | length > 0
      - journal_upload.addresses | length > 0
      - journal_upload.user | length > 0
      - journal_upload.password | length > 0
    fail_msg: journal_upload.host, addresses, user and password must be set

- name: Install the journal uploader
  ansible.builtin.apt:
    name: systemd-journal-remote
    install_recommends: false
    state: present

# A node reaching its own address arrives at Traefik from its cilium_host address, which the
# NetBird allowlist rejects; it takes the other nodes.
- name: Pin the ingest name to the NetBird addresses
  ansible.builtin.blockinfile:
    path: /etc/hosts
    marker: "# {mark} journal_upload"
    block: |
      {% for address in journal_upload.addresses | reject('in', ansible_facts.all_ipv4_addresses) %}
      {{ address }} {{ journal_upload.host }}
      {% endfor %}
  notify: Restart systemd-journal-upload

- name: Create the uploader config directory
  ansible.builtin.file:
    path: /etc/systemd/journal-upload.conf.d
    state: directory
    mode: "0755"

# The service runs as a dynamic user, which reads the file after the manager dropped privileges.
- name: Configure the upload URL
  ansible.builtin.copy:
    dest: /etc/systemd/journal-upload.conf.d/10-victorialogs.conf
    mode: "0644"
    content: |
      [Upload]
      URL=https://{{ journal_upload.user }}:{{ journal_upload.password }}@{{ journal_upload.host }}{{ journal_upload.path }}
      # No client certificate; the server certificate is checked against the system CAs.
      ServerKeyFile=-
      ServerCertificateFile=-
      TrustedCertificateFile=/etc/ssl/certs/ca-certificates.crt
  notify: Restart systemd-journal-upload
  no_log: true

# The default start limit (5 starts within 10 seconds) gives up during an ingest outage. The
# uploader resumes from its cursor, so it keeps retrying.
- name: Create the uploader unit drop-in directory
  ansible.builtin.file:
    path: /etc/systemd/system/systemd-journal-upload.service.d
    state: directory
    mode: "0755"

- name: Keep the uploader retrying through ingest outages
  ansible.builtin.copy:
    dest: /etc/systemd/system/systemd-journal-upload.service.d/restart.conf
    mode: "0644"
    content: |
      [Unit]
      StartLimitIntervalSec=0

      [Service]
      Restart=always
      RestartSec=30s
  notify: Reload systemd manager

# The reload has to precede the start below, which otherwise hits the default start limit.
- name: Load the uploader drop-in
  ansible.builtin.meta: flush_handlers

- name: Enable the journal uploader
  ansible.builtin.systemd:
    name: systemd-journal-upload
    enabled: true
    state: started
  # Check mode does not install the package.
  ignore_errors: "{{ ansible_check_mode }}"