---
# WEBRUNNER — Distributed geo-targeted recon
# Multi-provider: Linode, AWS, FlokiNET
# Controller: ~/tools/c2itall/ (CWD when ansible-playbook runs)

- name: WEBRUNNER — Provision scan nodes
  hosts: localhost
  connection: local
  gather_facts: false
  vars:
    ansible_python_interpreter: "{{ ansible_playbook_python }}"
    ssh_key_name: "{{ ssh_key_path | basename | regex_replace('\\.pub$', '') }}"
    all_node_chunks: "{{ lookup('file', node_chunks_file) | from_json }}"

  tasks:
    - name: Ensure results directory
      file:
        path: "{{ results_dir }}"
        state: directory
        mode: '0755'

    - name: Initialize scanner IP log
      copy:
        content: "# WEBRUNNER scanner IPs — {{ webrunner_name }}\n"
        dest: "{{ scanner_ip_log }}"
        mode: '0644'
        force: false

    - name: Provision Linode nodes
      include_tasks: "Linode/webrunner_provision_tasks.yml"
      loop: "{{ all_node_chunks | selectattr('provider', 'equalto', 'linode') | list }}"
      loop_control:
        loop_var: node_chunk

    - name: Provision AWS nodes
      include_tasks: "AWS/webrunner_provision_tasks.yml"
      loop: "{{ all_node_chunks | selectattr('provider', 'equalto', 'aws') | list }}"
      loop_control:
        loop_var: node_chunk

    - name: Provision FlokiNET nodes
      include_tasks: "FlokiNET/webrunner_provision_tasks.yml"
      loop: "{{ all_node_chunks | selectattr('provider', 'equalto', 'flokinet') | list }}"
      loop_control:
        loop_var: node_chunk


- name: WEBRUNNER — Configure and scan
  hosts: webrunner_nodes
  gather_facts: false
  become: true

  tasks:
    - name: Wait for SSH
      wait_for_connection:
        delay: 20
        timeout: 300

    - name: Configure node
      include_tasks: "{{ playbook_dir }}/../modules/webrunner/tasks/configure_node.yml"

    - name: Run scan
      include_tasks: "{{ playbook_dir }}/../modules/webrunner/tasks/run_scan.yml"

    - name: Collect results
      include_tasks: "{{ playbook_dir }}/../modules/webrunner/tasks/collect_results.yml"


- name: WEBRUNNER — Merge and report
  hosts: localhost
  connection: local
  gather_facts: false

  tasks:
    - name: Merge per-node results
      command: >
        python3 {{ playbook_dir }}/../modules/webrunner/tasks/merge_results.py
        --results-dir {{ results_dir }}
        --output {{ results_dir }}/merged_results.json
        --deployment-id {{ deployment_id }}
      register: merge_out
      ignore_errors: true

    - name: Show merge output
      debug:
        var: merge_out.stdout_lines
      when: merge_out.stdout_lines is defined and merge_out.stdout_lines | length > 0

    - name: Summary
      debug:
        msg:
          - "WEBRUNNER complete — {{ webrunner_name }}"
          - "Results: {{ results_dir }}/merged_results.json"
          - "Scanner IPs: {{ scanner_ip_log }}"
          - "Log: logs/deployment_{{ deployment_id }}.log"


- name: WEBRUNNER — Teardown scan nodes
  hosts: localhost
  connection: local
  gather_facts: false
  when: teardown_after_scan | default(true) | bool

  tasks:
    - name: Teardown Linode nodes
      uri:
        url: "https://api.linode.com/v4/linode/instances/{{ hostvars[item]['linode_instance_id'] }}"
        method: DELETE
        headers:
          Authorization: "Bearer {{ linode_token }}"
        status_code: [200, 204]
      loop: "{{ groups['webrunner_nodes'] | default([]) }}"
      when:
        - hostvars[item]['provider'] == 'linode'
        - hostvars[item]['linode_instance_id'] is defined
      ignore_errors: true

    - name: Teardown AWS nodes
      amazon.aws.ec2_instance:
        instance_ids:
          - "{{ hostvars[item]['ec2_instance_id'] }}"
        region: "{{ aws_region | default('us-east-1') }}"
        aws_access_key: "{{ aws_access_key | default('') }}"
        aws_secret_key: "{{ aws_secret_key | default('') }}"
        state: terminated
      loop: "{{ groups['webrunner_nodes'] | default([]) }}"
      when:
        - hostvars[item]['provider'] == 'aws'
        - hostvars[item]['ec2_instance_id'] is defined
      ignore_errors: true

    - name: Teardown complete
      debug:
        msg: "All WEBRUNNER scan nodes destroyed."
      when: groups['webrunner_nodes'] is defined and groups['webrunner_nodes'] | length > 0