---
- name: Refresh k3s server (blank slate except token/CA)
  hosts: k3s_hosts
  become: true
  serial: 1
  vars:
    # Safety guard: you must also pass `-e k3s_refresh_confirm=YES`.
    # Example:
    #   ./ansible.sh -v .vault_pass -p infrastructure/playbooks/k3s_server_refresh.yml -l myrddin.prole.org -- -e k3s_refresh_confirm=YES
    k3s_refresh_run_configure: true
  tasks:
    - name: Ensure cgroup kernel params are set
      ansible.builtin.import_role:
        name: cgroups

    - name: Refresh k3s server (preserve token/CA)
      ansible.builtin.import_role:
        name: k3s
        tasks_from: refresh_server