# PURPOSE: Detect host roles
# DESCRIPTION: Report detected AD, DHCP, Hyper-V, Veeam and UniFi capabilities without changing inventory memberships.
# TARGETS: linux, windows
# INPUTS (omitted values inherit inventory / role defaults):
#   aim_debug [bool]: false
# AUTH: existing inventory / Vault credentials; no embedded passwords.
# EXAMPLE: ansible-playbook -i inventories/<customer>/hosts.yml
#          playbooks/debug_detect_host_roles.yml --limit <host> --vault-id <customer>@prompt
  - name: Debug | Detected host roles
    hosts: linux:windows
    gather_facts: true
    pre_tasks:
      - name: AIM | Validate diagnostics option
        ansible.builtin.assert:
          that:
            - (aim_debug | default(false)) is boolean or (aim_debug | default(false) | string | lower) in 
              ['true', 'false']
          fail_msg: aim_debug must be a YAML/JSON boolean.
          quiet: true
      - name: AIM | Reject mixed platform membership
        ansible.builtin.assert:
          that:
            - (group_names | intersect(['linux', 'windows', 'sophosxgs', 'pfsense']) | length) <= 1
          fail_msg: This host belongs to incompatible platform groups. Use globally unique subgroups.
          quiet: true
      - name: AIM | Execution context
        ansible.builtin.debug:
          msg:
            host: '{{ inventory_hostname }}'
            diagnostics: Enabled; secret values are never included by this task.
        when: aim_debug | default(false) | bool
    roles:
      - role: system_detect_roles
    tasks:
      - name: Detection summary
        ansible.builtin.debug:
          msg:
            is_dc: '{{ is_dc | default(false) }}'
            is_dhcp_server: '{{ is_dhcp_server | default(false) }}'
            is_hyperv_host: '{{ is_hyperv_host | default(false) }}'
            has_veeam_vbr: '{{ has_veeam_vbr | default(false) }}'
            has_veeam_vbo: '{{ has_veeam_vbo | default(false) }}'
            has_veeam_em: '{{ has_veeam_em | default(false) }}'
            is_unifi_controller: '{{ is_unifi_controller | default(false) }}'
            is_unifi_os_server: '{{ is_unifi_os_server | default(false) }}'
      - name: AIM | Publish operation result
        ansible.builtin.set_stats:
          per_host: true
          aggregate: false
          data:
            aim_output:
              protocol: aim_output_v1
              schema: host_capabilities_v1
              data:
                is_dc: '{{ is_dc | default(false) | bool }}'
                is_dhcp_server: '{{ is_dhcp_server | default(false) | bool }}'
                is_hyperv_host: '{{ is_hyperv_host | default(false) | bool }}'
                has_veeam_vbr: '{{ has_veeam_vbr | default(false) | bool }}'
                has_veeam_vbo: '{{ has_veeam_vbo | default(false) | bool }}'
                has_veeam_em: '{{ has_veeam_em | default(false) | bool }}'
                is_unifi_controller: '{{ is_unifi_controller | default(false) | bool }}'
                is_unifi_os_server: '{{ is_unifi_os_server | default(false) | bool }}'