---

- name: Set effective k3s data-dir
  ansible.builtin.set_fact:
    k3s_effective_data_dir: "{{ k3s_data_dir | default('/var/lib/rancher/k3s', true) }}"

- name: Ensure k3s config exists
  ansible.builtin.stat:
    path: /etc/rancher/k3s/config.yaml
  register: k3s_config

- name: Fail when k3s config is missing
  ansible.builtin.debug:
    msg: "k3s config missing at /etc/rancher/k3s/config.yaml; creating minimal config for sync."
  when: not k3s_config.stat.exists

- name: Ensure k3s config directory exists when missing
  ansible.builtin.file:
    path: /etc/rancher/k3s
    state: directory
    owner: root
    group: "{{ k3s_kubeconfig_group | default('kubeadm') }}"
    mode: "0750"
  when: not k3s_config.stat.exists

- name: Create minimal k3s config when missing
  ansible.builtin.copy:
    dest: /etc/rancher/k3s/config.yaml
    owner: root
    group: "{{ k3s_kubeconfig_group | default('kubeadm') }}"
    mode: "0640"
    content: |
      {% if k3s_cluster_init | default(false) | bool %}
      cluster-init: true
      {% elif k3s_server_url | default('') %}
      server: "{{ k3s_server_url }}"
      {% endif %}
      {% if k3s_sync_token | default('') %}
      token: "{{ k3s_sync_token }}"
      {% endif %}
  when: not k3s_config.stat.exists

- name: Sync k3s token into config
  ansible.builtin.lineinfile:
    path: /etc/rancher/k3s/config.yaml
    regexp: "^token:"
    line: "token: \"{{ k3s_sync_token }}\""
    owner: root
    group: "{{ k3s_kubeconfig_group | default('kubeadm') }}"
    mode: "0640"

- name: Sync k3s server URL into config (join nodes)
  ansible.builtin.lineinfile:
    path: /etc/rancher/k3s/config.yaml
    regexp: "^server:"
    line: "server: \"{{ k3s_server_url }}\""
    owner: root
    group: "{{ k3s_kubeconfig_group | default('kubeadm') }}"
    mode: "0640"
  when:
    - k3s_server_url | default('') | length > 0

- name: Check if controller has conf/k3s.cfg (optional)
  ansible.builtin.stat:
    path: "{{ role_path }}/../../../conf/k3s.cfg"
  register: _k3s_prole_cfg_stat
  delegate_to: localhost
  when: k3s_registry_config_enabled | bool

- name: Load registry defaults from prole.cfg
  ansible.builtin.set_fact:
    k3s_prole_k3s_server_cfg: >-
      {{ lookup(
           'ansible.builtin.ini',
           'PROLE_K3S_SERVER section=Global file=' ~ (role_path ~ '/../../../conf/k3s.cfg'),
           default='',
           errors='ignore'
         ) if _k3s_prole_cfg_stat.stat.exists else '' }}
    k3s_prole_service_namespace_cfg: >-
      {{ lookup(
           'ansible.builtin.ini',
           'SERVICE_NAMESPACE section=Global file=' ~ (role_path ~ '/../../../conf/k3s.cfg'),
           default='',
           errors='ignore'
         ) if _k3s_prole_cfg_stat.stat.exists else '' }}
  when: k3s_registry_config_enabled | bool

- name: Resolve k3s registry host
  ansible.builtin.set_fact:
    k3s_registry_host_resolved: >-
      {{ (k3s_registry_host | default('')) if (k3s_registry_host | default('') | length > 0)
         else (k3s_prole_k3s_server_cfg | default('')) if (k3s_prole_k3s_server_cfg | default('') | length > 0)
         else inventory_hostname }}
  when: k3s_registry_config_enabled | bool

- name: Resolve k3s registry endpoint scheme
  ansible.builtin.set_fact:
    k3s_registry_endpoint_scheme_resolved: >-
      {{ 'https' if (k3s_registry_host | default('') | regex_search('^https://'))
         else 'http' if (k3s_registry_host | default('') | regex_search('^http://'))
         else (k3s_registry_endpoint_scheme | default('http')) }}
  when: k3s_registry_config_enabled | bool

- name: Normalize k3s registry host
  ansible.builtin.set_fact:
    k3s_registry_host_resolved: "{{ k3s_registry_host_resolved | regex_replace('^https?://', '') | regex_replace('/.*$', '') | regex_replace(':.*$', '') }}"
  when: k3s_registry_config_enabled | bool

- name: Normalize k3s registry endpoint scheme
  ansible.builtin.set_fact:
    k3s_registry_endpoint_scheme_resolved: "{{ (k3s_registry_endpoint_scheme_resolved | default('http') | lower) if (k3s_registry_endpoint_scheme_resolved | default('http') | lower) in ['http', 'https'] else 'http' }}"
  when: k3s_registry_config_enabled | bool

- name: Resolve k3s registry namespace
  ansible.builtin.set_fact:
    k3s_registry_namespace_resolved: >-
      {{ (k3s_registry_namespace | default('')) if (k3s_registry_namespace | default('') | length > 0 and k3s_registry_namespace != '${SERVICE_NAMESPACE}')
         else (k3s_prole_service_namespace_cfg | default('')) if (k3s_prole_service_namespace_cfg | default('') | length > 0 and k3s_prole_service_namespace_cfg != '${SERVICE_NAMESPACE}')
         else 'knoe-system' }}
  when: k3s_registry_config_enabled | bool

- name: Validate k3s registry host
  ansible.builtin.assert:
    that:
      - k3s_registry_host_resolved | length > 0
    fail_msg: "k3s registry host could not be resolved (set k3s_registry_host or PROLE_K3S_SERVER)."
  when: k3s_registry_config_enabled | bool

- name: Render k3s registries config
  ansible.builtin.template:
    src: registries.yaml.j2
    dest: "{{ k3s_registry_config_path }}"
    mode: "0644"
  when: k3s_registry_config_enabled | bool

- name: Ensure k3s server directory exists
  ansible.builtin.file:
    path: "{{ k3s_effective_data_dir }}/server"
    state: directory
    mode: "0755"
  when:
    - k3s_role == 'server'
    - k3s_sync_tls_bundle_present | default(false)

- name: Remove existing k3s tls directory before sync
  ansible.builtin.file:
    path: "{{ k3s_effective_data_dir }}/server/tls"
    state: absent
  when:
    - k3s_role == 'server'
    - k3s_sync_tls_bundle_present | default(false)

- name: Restore k3s tls bundle
  ansible.builtin.unarchive:
    src: "{{ k3s_sync_tls_bundle }}"
    dest: "{{ k3s_effective_data_dir }}/server"
    owner: root
    group: root
  when:
    - k3s_role == 'server'
    - k3s_sync_tls_bundle_present | default(false)