---
# Variable validation for forgejo role

- name: Validate Forgejo required variables
  ansible.builtin.assert:
    that:
      - forgejo_base_path is defined
      - forgejo_base_path | length > 0
      - forgejo_http_port is defined
      - forgejo_http_port | int > 0
      - forgejo_http_port | int < 65536
      - forgejo_domain is defined
      - forgejo_domain | length > 0
    fail_msg: |
      Forgejo role requires:
      - forgejo_base_path (installation directory)
      - forgejo_http_port (1-65535)
      - forgejo_domain (domain name)
    success_msg: "Forgejo basic variables validated successfully"

- name: Validate Forgejo secrets (if not using vault)
  ansible.builtin.assert:
    that:
      - forgejo_secret_key is defined
      - forgejo_secret_key | length >= 32
      - forgejo_internal_token is defined
      - forgejo_internal_token | length > 0
      - forgejo_jwt_secret is defined
      - forgejo_jwt_secret | length >= 32
      - forgejo_lfs_jwt_secret is defined
      - forgejo_lfs_jwt_secret | length >= 32
    fail_msg: |
      Forgejo role requires secrets:
      - forgejo_secret_key (min 32 chars)
      - forgejo_internal_token
      - forgejo_jwt_secret (min 32 chars)
      - forgejo_lfs_jwt_secret (min 32 chars)

      WARNING: These should be stored in Ansible Vault!
    success_msg: "Forgejo secrets validated (WARNING: should use Ansible Vault)"
  when: not ansible_check_mode