---
- name: Upgrade Debian avec become_pass dynamique
  hosts: all
  gather_facts: false
  become: true
  become_method: sudo

  pre_tasks:
    - name: Charger les variables vault (become_passwords)
      ansible.builtin.include_vars:
        file: "../group_vars/all/vault.yml"
        name: vault_secrets

    - name: Définir le mot de passe sudo
      ansible.builtin.set_fact:
        ansible_become_pass: "{{ vault_secrets.become_passwords[inventory_hostname] }}"

    - name: Charger les facts système (setup)
      ansible.builtin.setup:

  tasks:
    - name: Mise à jour du cache APT
      ansible.builtin.apt:
        update_cache: yes
        cache_valid_time: 3600

    - name: Upgrade des paquets
      ansible.builtin.apt:
        upgrade: dist
        autoremove: yes
        autoclean: yes