---
# AWS Cleanup Playbook

- name: Clean up AWS resources
  hosts: localhost
  gather_facts: false
  connection: local
  vars_files:
    - vars.yaml
  vars:
    delete_results: {}

  tasks:
    - name: Confirm cleanup
      pause:
        prompt: "This will delete all AWS resources for deployment ID {{ deployment_id }}. Continue? (yes/no)"
      register: confirm_deletion
      when: confirm_cleanup | default(true) | bool

    - name: Check confirmation
      assert:
        that: confirm_deletion.user_input | default('yes') | lower == 'yes'
        fail_msg: "Cleanup cancelled by user"
      when: confirm_cleanup | default(true) | bool

    # C2 server cleanup
    - name: Terminate C2 instances
      amazon.aws.ec2_instance:
        state: absent
        region: "{{ aws_region }}"
        filters:
          "tag:Name": "{{ c2_name }}"
      register: c2_instances_result
      when: cleanup_c2 | default(true) | bool

    # Redirector cleanup
    - name: Terminate redirector instances
      amazon.aws.ec2_instance:
        state: absent
        region: "{{ aws_region }}"
        filters:
          "tag:Name": "{{ redirector_name }}"
      register: redirector_instances_result
      when: cleanup_redirector | default(true) | bool
      
    # Tracker cleanup
    - name: Terminate tracker instances
      amazon.aws.ec2_instance:
        state: absent
        region: "{{ aws_region }}"
        filters:
          "tag:Name": "{{ tracker_name | default('t-' + deployment_id) }}"
      register: tracker_instances_result
      when: cleanup_tracker | default(true) | bool and track_deployment | default(false) | bool
      
    # We need to wait a bit for instances to terminate before we can clean up security groups
    - name: Wait for instances to terminate
      pause:
        seconds: 30
      when: cleanup_c2 | default(true) | bool or cleanup_redirector | default(true) | bool or (cleanup_tracker | default(true) | bool and track_deployment | default(false) | bool)
      
    # Delete key pairs
    - name: Delete C2 EC2 key pair
      amazon.aws.ec2_key:
        name: "{{ c2_name }}"
        region: "{{ aws_region }}"
        state: absent
      register: c2_key_result
      when: cleanup_c2 | default(true) | bool
      
    - name: Delete redirector EC2 key pair
      amazon.aws.ec2_key:
        name: "{{ redirector_name }}"
        region: "{{ aws_region }}"
        state: absent
      register: redirector_key_result
      when: cleanup_redirector | default(true) | bool
      
    - name: Delete tracker EC2 key pair
      amazon.aws.ec2_key:
        name: "{{ tracker_name | default('t-' + deployment_id) }}"
        region: "{{ aws_region }}"
        state: absent
      register: tracker_key_result
      when: cleanup_tracker | default(true) | bool and track_deployment | default(false) | bool
      
    # Security Groups
    - name: Delete C2 security group
      amazon.aws.ec2_security_group:
        name: "{{ c2_name }}-sg"
        region: "{{ aws_region }}"
        state: absent
      register: c2_sg_result
      ignore_errors: yes
      when: cleanup_c2 | default(true) | bool
      
    - name: Delete redirector security group
      amazon.aws.ec2_security_group:
        name: "{{ redirector_name }}-sg"
        region: "{{ aws_region }}"
        state: absent
      register: redirector_sg_result
      ignore_errors: yes
      when: cleanup_redirector | default(true) | bool
      
    - name: Delete tracker security group
      amazon.aws.ec2_security_group:
        name: "{{ tracker_name | default('t-' + deployment_id) }}-sg"
        region: "{{ aws_region }}"
        state: absent
      register: tracker_sg_result
      ignore_errors: yes
      when: cleanup_tracker | default(true) | bool and track_deployment | default(false) | bool
      
    # VPC Resources
    - name: Get VPCs
      amazon.aws.ec2_vpc_net_info:
        region: "{{ aws_region }}"
        filters:
          "tag:deployment_id": "{{ deployment_id }}"
      register: vpc_info
      
    - name: Get subnets
      amazon.aws.ec2_vpc_subnet_info:
        region: "{{ aws_region }}"
        filters:
          "tag:deployment_id": "{{ deployment_id }}"
      register: subnet_info
      
    - name: Get route tables
      amazon.aws.ec2_vpc_route_table_info:
        region: "{{ aws_region }}"
        filters:
          "tag:deployment_id": "{{ deployment_id }}"
      register: route_table_info
      
    - name: Get internet gateways
      amazon.aws.ec2_vpc_igw_info:
        region: "{{ aws_region }}"
        filters:
          "tag:deployment_id": "{{ deployment_id }}"
      register: igw_info
    
    # Get and delete any remaining network interfaces in these VPCs
    - name: Get network interfaces in VPCs
      amazon.aws.ec2_eni_info:
        region: "{{ aws_region }}"
        filters:
          vpc-id: "{{ item.vpc_id }}"
      loop: "{{ vpc_info.vpcs }}"
      register: eni_info
      
    - name: Delete network interfaces
      amazon.aws.ec2_eni:
        region: "{{ aws_region }}"
        eni_id: "{{ item.1.network_interface_id }}"
        state: absent
        force_detach: true
      loop: "{{ eni_info.results | subelements('network_interfaces', skip_missing=true) }}"
      register: eni_deleted
      ignore_errors: yes
      
    # Delete VPC resources
    - name: Delete route tables
      amazon.aws.ec2_vpc_route_table:
        region: "{{ aws_region }}"
        vpc_id: "{{ item.vpc_id }}"
        route_table_id: "{{ item.id }}"
        state: absent
      loop: "{{ route_table_info.route_tables }}"
      register: route_tables_deleted
      ignore_errors: yes
      
    - name: Delete internet gateways
      amazon.aws.ec2_vpc_igw:
        region: "{{ aws_region }}"
        vpc_id: "{{ item.attachments[0].vpc_id }}"
        state: absent
      loop: "{{ igw_info.internet_gateways }}"
      register: igws_deleted
      ignore_errors: yes
      
    - name: Delete subnets
      amazon.aws.ec2_vpc_subnet:
        region: "{{ aws_region }}"
        vpc_id: "{{ item.vpc_id }}"
        cidr: "{{ item.cidr_block }}"
        state: absent
      loop: "{{ subnet_info.subnets }}"
      register: subnets_deleted
      ignore_errors: yes
      
    # Wait before trying to delete VPCs to allow AWS to catch up on dependency deletions
    - name: Wait for AWS to process subnet and gateway deletions
      pause:
        seconds: 15
        
    - name: Delete VPCs
      amazon.aws.ec2_vpc_net:
        region: "{{ aws_region }}"
        vpc_id: "{{ item.id }}"
        state: absent
      loop: "{{ vpc_info.vpcs }}"
      register: vpcs_deleted
      ignore_errors: yes
      
    # Create summary of deleted resources
    - name: Collect all deleted resources
      set_fact:
        resource_summary:
          ec2_instances:
            c2: "{{ c2_instances_result.instance_ids | default([]) }}"
            redirector: "{{ redirector_instances_result.instance_ids | default([]) }}"
            tracker: "{{ tracker_instances_result.instance_ids | default([]) }}"
          key_pairs:
            c2: "{{ c2_key_result.key.name | default('') | ternary([c2_key_result.key.name], []) }}"
            redirector: "{{ redirector_key_result.key.name | default('') | ternary([redirector_key_result.key.name], []) }}"
            tracker: "{{ tracker_key_result.key.name | default('') | ternary([tracker_key_result.key.name], []) }}"
          security_groups:
            c2: "{{ c2_sg_result.group_id | default('') | ternary([c2_sg_result.group_id], []) }}"
            redirector: "{{ redirector_sg_result.group_id | default('') | ternary([redirector_sg_result.group_id], []) }}"
            tracker: "{{ tracker_sg_result.group_id | default('') | ternary([tracker_sg_result.group_id], []) }}"
          vpc_resources:
            route_tables: "{{ route_tables_deleted.results | default([]) | map(attribute='item.id', default='') | select() | list }}"
            internet_gateways: "{{ igws_deleted.results | default([]) | map(attribute='gateway_id', default='') | select() | list }}"
            subnets: "{{ subnets_deleted.results | default([]) | map(attribute='subnet.id', default='') | select() | list }}"
            network_interfaces: "{{ eni_deleted.results | default([]) | map(attribute='interface.id', default='') | select() | list }}"
            vpcs: "{{ vpcs_deleted.results | default([]) | map(attribute='vpc.id', default='') | select() | list }}"
      when: not disable_summary | default(false)
      
    # Display summary of deleted resources
    - name: Display cleanup summary
      debug:
        msg:
          - "=========================================================="
          - "CLEANUP SUMMARY FOR DEPLOYMENT ID: {{ deployment_id }}"
          - "=========================================================="
          - "EC2 INSTANCES DELETED:"
          - "  C2: {{ resource_summary.ec2_instances.c2 }}"
          - "  Redirector: {{ resource_summary.ec2_instances.redirector }}"
          - "  Tracker: {{ resource_summary.ec2_instances.tracker }}"
          - ""
          - "KEY PAIRS DELETED:"
          - "  C2: {{ resource_summary.key_pairs.c2 }}"
          - "  Redirector: {{ resource_summary.key_pairs.redirector }}"
          - "  Tracker: {{ resource_summary.key_pairs.tracker }}"
          - ""
          - "SECURITY GROUPS DELETED:"
          - "  C2: {{ resource_summary.security_groups.c2 }}"
          - "  Redirector: {{ resource_summary.security_groups.redirector }}"
          - "  Tracker: {{ resource_summary.security_groups.tracker }}"
          - ""
          - "VPC RESOURCES DELETED:"
          - "  Route Tables: {{ resource_summary.vpc_resources.route_tables }}"
          - "  Internet Gateways: {{ resource_summary.vpc_resources.internet_gateways }}"
          - "  Subnets: {{ resource_summary.vpc_resources.subnets }}"
          - "  Network Interfaces: {{ resource_summary.vpc_resources.network_interfaces }}"
          - "  VPCs: {{ resource_summary.vpc_resources.vpcs }}"
          - "=========================================================="
      when: not disable_summary | default(false)