---
# =============================================================================
# Full Cleanup - Remove everything including data
# =============================================================================
# WARNING: This will delete all NetBird data including:
#   - Peer configurations
#   - User accounts
#   - Groups and policies
#   - TLS certificates
#
# Run: ansible-playbook -i inventory.yml cleanup-full.yml

- name: Full Cleanup - Remove everything
  hosts: netbird_servers
  become: true
  vars_files:
    - group_vars/netbird_servers.yml

  tasks:
    - name: Check if docker-compose.yml exists
      ansible.builtin.stat:
        path: "{{ netbird_base_dir }}/docker-compose.yml"
      register: compose_file

    - name: Stop and remove containers with volumes
      ansible.builtin.command:
        cmd: docker compose down -v
        chdir: "{{ netbird_base_dir }}"
      when: compose_file.stat.exists
      changed_when: true

    - name: Remove any orphaned NetBird volumes
      ansible.builtin.command:
        cmd: docker volume rm {{ item }}
      loop:
        - netbird_management
        - netbird_caddy_data
      ignore_errors: true
      changed_when: true

    - name: Remove configuration directory
      ansible.builtin.file:
        path: "{{ netbird_base_dir }}"
        state: absent

    - name: Prune unused Docker images
      ansible.builtin.command:
        cmd: docker image prune -af --filter "label=org.opencontainers.image.title=netbird*"
      changed_when: true
      ignore_errors: true

    - name: Display cleanup summary
      ansible.builtin.debug:
        msg: |
          ============================================
          Full Cleanup Complete!
          ============================================

          Removed:
          - All NetBird containers
          - All NetBird Docker volumes
          - Configuration directory: {{ netbird_base_dir }}
          - Unused NetBird Docker images

          NetBird has been completely removed.
          To redeploy, run the appropriate playbook:
            ansible-playbook playbook-ssl-ip.yml -i inventory.yml --ask-vault-pass
          or
            ansible-playbook playbook-ssl.yml -i inventory.yml --ask-vault-pass
          or
            ansible-playbook playbook-no-ssl.yml -i inventory.yml --ask-vault-pass

          Then bootstrap admin:
            ansible-playbook setup-bootstrap.yml -i inventory.yml --ask-vault-pass
          ============================================