---
- name: Ensure k3s config exists
  ansible.builtin.stat:
    path: /etc/rancher/k3s/config.yaml
  register: k3s_config

- name: Fail when k3s config is missing
  ansible.builtin.fail:
    msg: "k3s config is missing at /etc/rancher/k3s/config.yaml. Run the k3s role first."
  when: not k3s_config.stat.exists

- name: Sync k3s token into config
  ansible.builtin.lineinfile:
    path: /etc/rancher/k3s/config.yaml
    regexp: "^token:"
    line: "token: \"{{ k3s_sync_token }}\""
    mode: "0640"

- name: Ensure k3s server directory exists
  ansible.builtin.file:
    path: /var/lib/rancher/k3s/server
    state: directory
    mode: "0755"
  when: k3s_sync_tls_bundle_present | default(false)

- name: Remove existing k3s tls directory before sync
  ansible.builtin.file:
    path: /var/lib/rancher/k3s/server/tls
    state: absent
  when: k3s_sync_tls_bundle_present | default(false)

- name: Restore k3s tls bundle
  ansible.builtin.unarchive:
    src: "{{ k3s_sync_tls_bundle }}"
    dest: /var/lib/rancher/k3s/server
    owner: root
    group: root
  when: k3s_sync_tls_bundle_present | default(false)