---
- name: Safely update Webmin on all hosts
  hosts: all
  become: yes
  vars:
    webmin_repo: "deb http://download.webmin.com/download/repository sarge contrib"
    webmin_key_url: "http://www.webmin.com/jcameron-key.asc"

  tasks:

    - name: Ensure required packages are installed for HTTPS repositories
      apt:
        name:
          - apt-transport-https
          - software-properties-common
          - gnupg
        state: present
        update_cache: yes

    - name: Add Webmin GPG key (idempotent)
      ansible.builtin.apt_key:
        url: "{{ webmin_key_url }}"
        state: present

    - name: Ensure Webmin repository is present
      ansible.builtin.apt_repository:
        repo: "{{ webmin_repo }}"
        state: present

    - name: Update apt cache
      apt:
        update_cache: yes

    - name: Check if Webmin is installed
      command: dpkg -l webmin
      register: webmin_installed
      ignore_errors: yes

    - name: Upgrade Webmin if installed
      apt:
        name: webmin
        state: latest
      when: webmin_installed.rc == 0

    - name: Install Webmin if not installed
      apt:
        name: webmin
        state: present
      when: webmin_installed.rc != 0

    - name: Ensure Webmin service is running
      systemd:
        name: webmin
        state: restarted
        enabled: yes