---
# Ensures cert-manager is installed and the letsencrypt-prod ClusterIssuer
# (HTTP-01 / Traefik) is configured in the k3s cluster.
# The multi-SAN cert for db/svc/api/git.prole.org is issued automatically
# by cert-manager once prole-svc-ingress.yaml is applied (annotation-driven).
- name: Ensure cert-manager and letsencrypt-prod ClusterIssuer
  hosts: k3s_servers
  become: true
  tasks:
    - name: Install cert-manager
      ansible.builtin.include_tasks: "{{ playbook_dir }}/../roles/k3s/tasks/certmgr.yml"

    - name: Configure ACME ClusterIssuer and service certificate
      ansible.builtin.include_tasks: "{{ playbook_dir }}/../roles/k3s/tasks/acme_cert.yml"