---
- name: Prepare k3s synchronization on controller
  hosts: localhost
  gather_facts: false
  vars:
    k3s_sync_source_host: >-
      {{ (groups['k3s_hosts'] | select('extract', hostvars, 'k3s_cluster_init') | list | first) | default('') }}
  tasks:
    - name: Require a k3s init server as sync source
      ansible.builtin.assert:
        that:
          - k3s_sync_source_host | length > 0
        fail_msg: "No k3s init server found. Ensure a host has k3s_cluster_init: true."

    - name: Add k3s sync source host
      ansible.builtin.add_host:
        name: "{{ k3s_sync_source_host }}"
        groups: k3s_sync_source

    - name: Create local temp directory for k3s sync
      ansible.builtin.tempfile:
        state: directory
        prefix: k3s-sync-
      register: k3s_sync_tmpdir

    - name: Store k3s sync metadata
      ansible.builtin.set_fact:
        k3s_sync_source_host: "{{ k3s_sync_source_host }}"
        k3s_sync_tmpdir_path: "{{ k3s_sync_tmpdir.path }}"
        k3s_sync_tls_bundle: "{{ k3s_sync_tmpdir.path }}/k3s-tls.tgz"

- name: Collect k3s token and certs from init server
  hosts: k3s_sync_source
  become: true
  tasks:
    - name: Ensure k3s node token exists
      ansible.builtin.stat:
        path: /var/lib/rancher/k3s/server/node-token
      register: k3s_node_token

    - name: Fail when k3s node token is missing
      ansible.builtin.fail:
        msg: "k3s node token not found at /var/lib/rancher/k3s/server/node-token"
      when: not k3s_node_token.stat.exists

    - name: Read k3s node token
      ansible.builtin.slurp:
        src: /var/lib/rancher/k3s/server/node-token
      register: k3s_node_token_raw

    - name: Store k3s sync token on controller
      ansible.builtin.set_fact:
        k3s_sync_token: "{{ k3s_node_token_raw.content | b64decode | trim }}"
      delegate_to: localhost

    - name: Check for k3s tls directory
      ansible.builtin.stat:
        path: /var/lib/rancher/k3s/server/tls
      register: k3s_tls_dir

    - name: Create k3s tls bundle
      ansible.builtin.archive:
        path: /var/lib/rancher/k3s/server/tls
        dest: /tmp/k3s-tls.tgz
        format: gz
      when: k3s_tls_dir.stat.exists

    - name: Fetch k3s tls bundle
      ansible.builtin.fetch:
        src: /tmp/k3s-tls.tgz
        dest: "{{ hostvars['localhost'].k3s_sync_tls_bundle }}"
        flat: true
      when: k3s_tls_dir.stat.exists

    - name: Mark tls bundle presence on controller
      ansible.builtin.set_fact:
        k3s_sync_tls_bundle_present: "{{ k3s_tls_dir.stat.exists }}"
      delegate_to: localhost

    - name: Remove temporary tls bundle from source
      ansible.builtin.file:
        path: /tmp/k3s-tls.tgz
        state: absent
      when: k3s_tls_dir.stat.exists

- name: Synchronize k3s token and certs to servers
  hosts: k3s_hosts
  become: true
  serial: 1
  vars:
    k3s_sync_source_host: "{{ hostvars['localhost'].k3s_sync_source_host }}"
    k3s_sync_token: "{{ hostvars['localhost'].k3s_sync_token | default('') }}"
    k3s_sync_tls_bundle: "{{ hostvars['localhost'].k3s_sync_tls_bundle | default('') }}"
    k3s_sync_tls_bundle_present: "{{ hostvars['localhost'].k3s_sync_tls_bundle_present | default(false) }}"
  pre_tasks:
    - name: Require k3s sync token
      ansible.builtin.assert:
        that:
          - k3s_sync_token | length > 0
        fail_msg: "k3s sync token is empty. Check the init server token."
  tasks:
    - name: Stop k3s before syncing
      ansible.builtin.import_role:
        name: k3s
        tasks_from: stop
      when: inventory_hostname != k3s_sync_source_host

    - name: Sync k3s token and certs
      ansible.builtin.import_role:
        name: k3s
        tasks_from: sync
      when: inventory_hostname != k3s_sync_source_host