---
when: k3s_enabled | default(true)

- name: Check if k3s service is installed
  ansible.builtin.stat:
    path: /etc/systemd/system/k3s.service
  register: k3s_service

- name: Check if k3s binary exists
  ansible.builtin.stat:
    path: /usr/local/bin/k3s
  register: k3s_bin

- name: Determine if k3s needs installation
  ansible.builtin.set_fact:
    k3s_needs_install: "{{ not k3s_bin.stat.exists or not k3s_service.stat.exists }}"

- name: Install k3s dependencies
  ansible.builtin.package:
    name:
      - curl
      - iptables
    state: present

- name: Preflight - ensure /var/lib/rancher is mounted
  ansible.builtin.command: "findmnt -n /var/lib/rancher"
  register: rancher_mounted
  changed_when: false
  failed_when: rancher_mounted.rc != 0

- name: Guardrail - ensure /var/lib/rancher is not on SD/rootfs
  ansible.builtin.command: "findmnt -n -o SOURCE /var/lib/rancher"
  register: rancher_source
  changed_when: false

- name: Fail if /var/lib/rancher is on SD
  ansible.builtin.fail:
    msg: "/var/lib/rancher is on SD/rootfs ({{ rancher_source.stdout }}). Refusing to proceed."
  when: rancher_source.stdout is search("mmcblk0") or rancher_source.stdout is search("/dev/mmc")