---

- name: add unifi-protect-viewport user
  become: yes
  user:
    name: "{{unifi_protect_viewport_user}}"
    shell: "/bin/false"
    system: "yes"
    create_home: "no"
    groups: "video,input,render,tty"
    append: "yes"

- name: allow unifi-protect-viewport user to control sysfs backlight
  become: yes
  copy:
    dest: "/etc/udev/rules.d/99-unifi-protect-viewport-backlight.rules"
    owner: "root"
    group: "root"
    mode: "0644"
    content: |
      SUBSYSTEM=="backlight", ACTION=="add", RUN+="/bin/chgrp video /sys/class/backlight/%k/brightness", RUN+="/bin/chmod g+w /sys/class/backlight/%k/brightness"

- name: set backlight brightness writable by video group
  become: yes
  file:
    path: "/sys/class/backlight/rpi_backlight/brightness"
    group: "video"
    mode: "0664"

- name: apt install unifi-protect-viewport dependencies
  become: yes
  apt: name="{{item}}"
  notify: restart unifi-protect-viewport
  loop:
    - "mpv"
    - "python3-evdev"
    - "python3-requests"
    - "python3-websockets"

- name: create unifi-protect-viewport config dir
  become: yes
  file:
    path: "/etc/unifi-protect-viewport"
    owner: "root"
    group: "{{unifi_protect_viewport_user}}"
    mode: "0750"
    state: "directory"

- name: install unifi-protect-viewport daemon
  become: yes
  copy:
    src: "unifi-protect-viewport.py"
    dest: "/usr/local/bin/unifi-protect-viewport"
    owner: "root"
    group: "root"
    mode: "0755"
  notify: restart unifi-protect-viewport

- name: install unifi-protect-viewport debug tool
  become: yes
  copy:
    src: "unifi-protect-viewport-debug"
    dest: "/usr/local/bin/unifi-protect-viewport-debug"
    owner: "root"
    group: "root"
    mode: "0755"

- name: configure unifi-protect-viewport environment
  become: yes
  template:
    src: "unifi-protect-viewport.env.j2"
    dest: "/etc/unifi-protect-viewport/unifi-protect-viewport.env"
    owner: "root"
    group: "{{unifi_protect_viewport_user}}"
    mode: "0640"
  notify: restart unifi-protect-viewport
  no_log: true

- name: install unifi-protect-viewport systemd service
  become: yes
  template:
    src: "unifi-protect-viewport.service.j2"
    dest: "/lib/systemd/system/unifi-protect-viewport.service"
    mode: "0644"
  notify: restart unifi-protect-viewport

- name: configure PoE HAT fan temperature thresholds
  become: yes
  blockinfile:
    path: "/boot/firmware/config.txt"
    marker: "# {mark} unifi-protect-viewport poe fan"
    block: |
      dtoverlay=rpi-poe
      dtparam=poe_fan_temp0={{unifi_protect_viewport_poe_fan_temp0}},poe_fan_temp0_hyst=5000
      dtparam=poe_fan_temp1={{unifi_protect_viewport_poe_fan_temp1}},poe_fan_temp1_hyst=5000
      dtparam=poe_fan_temp2={{unifi_protect_viewport_poe_fan_temp2}},poe_fan_temp2_hyst=5000
      dtparam=poe_fan_temp3={{unifi_protect_viewport_poe_fan_temp3}},poe_fan_temp3_hyst=5000
  when: unifi_protect_viewport_poe_fan
  register: fan_result

- name: remind to reboot for PoE fan config to take effect
  debug:
    msg: "config.txt updated — reboot {{inventory_hostname}} for PoE HAT fan thresholds to take effect"
  when: fan_result is not skipped and fan_result.changed

- name: enable vc4 KMS DRM driver
  become: yes
  lineinfile:
    path: "/boot/firmware/config.txt"
    line: "dtoverlay=vc4-fkms-v3d"
    regexp: "^dtoverlay=vc4-(f?)kms-v3d"
  register: vc4_result

- name: remind to reboot for vc4 DRM driver to take effect
  debug:
    msg: "config.txt updated — reboot {{inventory_hostname}} for dtoverlay=vc4-fkms-v3d to take effect"
  when: vc4_result.changed

- name: disable fbcon to free DRM device for mpv
  become: yes
  lineinfile:
    path: "/boot/firmware/cmdline.txt"
    backrefs: yes
    regexp: "^((?!.*fbcon=map:99).*)$"
    line: "\\1 fbcon=map:99"
  register: cmdline_result

- name: remind to reboot for cmdline.txt change to take effect
  debug:
    msg: "cmdline.txt updated — reboot {{inventory_hostname}} for fbcon=map:99 to take effect"
  when: cmdline_result.changed

- name: ensure unifi-protect-viewport is started
  become: yes
  systemd: name="unifi-protect-viewport.service" enabled="yes" state="started" daemon_reload="yes"