packer {
  required_plugins {
    azure = {
      source  = "github.com/hashicorp/azure"
      version = "~> 2"
    }
    ansible = {
      source  = "github.com/hashicorp/ansible"
      version = "~> 1"
    }
  }
}

variable "subscription_id" {
  type    = string
  default = env("ARM_SUBSCRIPTION_ID")
}

variable "image_version" {
  type        = string
  description = "SemVer der Image-Version, z. B. 1.0.0"
}

variable "location" {
  type    = string
  default = "germanywestcentral"
}

source "azure-arm" "web" {
  use_azure_cli_auth = true
  subscription_id    = var.subscription_id
  location           = var.location
  vm_size            = "Standard_B2s"

  os_type         = "Linux"
  image_publisher = "Canonical"
  image_offer     = "ubuntu-24_04-lts"
  image_sku       = "server"

  # Optional: SSH auf die temporäre Build-VM auf die eigene IP beschränken
  # allowed_inbound_ip_addresses = ["203.0.113.10"]

  shared_image_gallery_destination {
    subscription         = var.subscription_id
    resource_group       = "rg-iaclab-base"
    gallery_name         = "gal_iaclab"
    image_name           = "img-web-ubuntu2404"
    image_version        = var.image_version
    replication_regions  = [var.location]
    storage_account_type = "Standard_LRS"
  }

  azure_tags = {
    managed_by    = "packer"
    project       = "iac-lab"
    image_version = var.image_version
  }
}

build {
  sources = ["source.azure-arm.web"]

  # Warten, bis cloud-init der Build-VM fertig ist (sonst apt-Locks)
  provisioner "shell" {
    inline = ["cloud-init status --wait"]
  }

  provisioner "ansible" {
    playbook_file    = "${path.root}/../ansible/web.yml"
    use_proxy        = false
    ansible_env_vars = ["ANSIBLE_HOST_KEY_CHECKING=False"]
    extra_arguments  = ["--extra-vars", "image_version=${var.image_version}"]
  }

  # Generalisieren: Muss der letzte Schritt sein
  provisioner "shell" {
    execute_command = "chmod +x {{ .Path }}; {{ .Vars }} sudo -E sh '{{ .Path }}'"
    inline_shebang  = "/bin/sh -x"
    inline = [
      "apt-get clean",
      "cloud-init clean --logs --seed --machine-id",
      "/usr/sbin/waagent -force -deprovision+user && export HISTSIZE=0 && sync"
    ]
  }
}