---
- name: Validate k3s API endpoint reachability
  hosts: k3s_hosts
  gather_facts: false
  become: false
  vars:
    k3s_default_port: 6443
  tasks:
    - name: Select k3s init host
      ansible.builtin.set_fact:
        k3s_init_host: "{{ item }}"
      when: hostvars[item].k3s_cluster_init | default(false) | bool
      loop: "{{ groups['k3s_hosts'] }}"
      run_once: true

    - name: Select k3s server URL (if provided)
      ansible.builtin.set_fact:
        k3s_api_url: "{{ hostvars[item].k3s_server_url }}"
      when:
        - hostvars[item].k3s_server_url is defined
        - hostvars[item].k3s_server_url | length > 0
      loop: "{{ groups['k3s_hosts'] }}"
      run_once: true

    - name: Fallback to init host URL
      ansible.builtin.set_fact:
        k3s_api_url: "https://{{ k3s_init_host | default(groups['k3s_hosts'][0]) }}:{{ k3s_default_port }}"
      when: k3s_api_url is not defined or k3s_api_url | length == 0
      run_once: true

    - name: Extract k3s API host
      ansible.builtin.set_fact:
        k3s_api_host: "{{ k3s_api_url | regex_replace('^https?://', '') | regex_replace(':.*$', '') }}"
      run_once: true

    - name: Check TCP port 6443
      ansible.builtin.wait_for:
        host: "{{ k3s_api_host }}"
        port: "{{ k3s_default_port }}"
        timeout: 10
      delegate_to: localhost
      become: false
      run_once: true

    - name: Check /readyz endpoint
      ansible.builtin.uri:
        url: "{{ k3s_api_url }}/readyz"
        method: GET
        status_code: [200, 401, 403]
        validate_certs: false
        timeout: 5
      delegate_to: localhost
      become: false
      run_once: true

    - name: Report k3s API endpoint
      ansible.builtin.debug:
        msg: "k3s API reachable at {{ k3s_api_url }}"
      run_once: true