---
- name: 'Copy config for "{{ service }}"'
  template:
    src: "{{ service_path }}/config/config.yml"
    dest: "{{ remote_service_path }}/config/config.yml"
  register: registry_config
  tags:
    - config

# Registry checks the bcrypt hash on every request, so a low cost keeps it fast.
# Salt is derived from the user name to keep the file stable between runs.
- name: 'Generate passwords file for "{{ service }}"'
  ansible.builtin.copy:
    dest: "{{ remote_service_path }}/config/htpasswd"
    content: |
      {% for registry_user in registry_users %}
      {{ registry_user.name }}:{{ registry_user.password | password_hash('bcrypt', salt=((service ~ ':' ~ registry_user.name) | hash('sha256'))[:22], rounds=registry_bcrypt_rounds) }}
      {% endfor %}
    mode: "0600"
  no_log: true
  tags:
    - config

- name: 'Compute config hash for passwords file of "{{ service }}"'
  ansible.builtin.stat:
    path: "{{ remote_service_path }}/config/htpasswd"
    get_mime: no
    get_attributes: no
    get_checksum: yes
  register: registry_htpasswd