---

- name: Skip k3s when state is absent
  ansible.builtin.meta: end_host
  when: k3s_state == "absent"

- name: Set k3s service name
  ansible.builtin.set_fact:
    k3s_service_name: "{{ 'k3s' if k3s_role == 'server' else 'k3s-agent' }}"

- name: Check if k3s service is installed
  ansible.builtin.stat:
    path: "/etc/systemd/system/{{ k3s_service_name }}.service"
  register: k3s_service

- name: Check if k3s binary exists
  ansible.builtin.stat:
    path: /usr/local/bin/k3s
  register: k3s_bin

- name: Determine if k3s needs installation
  ansible.builtin.set_fact:
    k3s_needs_install: "{{ not k3s_bin.stat.exists or not k3s_service.stat.exists }}"

- name: Install k3s dependencies
  ansible.builtin.package:
    name:
      - curl
      - iptables
    state: present

- name: Preflight - ensure rancher mountpoint is mounted
  ansible.builtin.command: "findmnt -n {{ k3s_rancher_mountpoint | default('/var/lib/rancher') }}"
  register: rancher_mounted
  changed_when: false
  failed_when: rancher_mounted.rc != 0

- name: Guardrail - ensure rancher mountpoint is not on SD/rootfs
  ansible.builtin.command: "findmnt -n -o SOURCE {{ k3s_rancher_mountpoint | default('/var/lib/rancher') }}"
  register: rancher_source
  changed_when: false

- name: Fail if rancher mountpoint is on SD
  ansible.builtin.fail:
    msg: "{{ k3s_rancher_mountpoint | default('/var/lib/rancher') }} is on SD/rootfs ({{ rancher_source.stdout }}). Refusing to proceed."
  when: rancher_source.stdout is search("mmcblk0") or rancher_source.stdout is search("/dev/mmc")

- name: Validate join configuration
  ansible.builtin.assert:
    that:
      - k3s_server_url is defined
      - k3s_server_url | length > 0
      - k3s_token is defined
      - k3s_token | length > 0
    fail_msg: "k3s_server_url and k3s_token are required for non-init nodes."
  when: not k3s_cluster_init | bool

- name: Ensure k3s config directory exists
  ansible.builtin.file:
    path: /etc/rancher/k3s
    state: directory
    mode: "0755"

- name: Ensure kubeconfig group exists (server)
  ansible.builtin.group:
    name: "{{ k3s_kubeconfig_group }}"
    state: present
  when: k3s_role == "server"

- name: Ensure kubeconfig users are in group (server)
  ansible.builtin.user:
    name: "{{ item }}"
    groups: "{{ k3s_kubeconfig_group }}"
    append: true
  loop: "{{ k3s_kubeconfig_users }}"
  when: k3s_role == "server" and (k3s_kubeconfig_users | length) > 0

- name: Render k3s config
  ansible.builtin.template:
    src: config.yaml.j2
    dest: /etc/rancher/k3s/config.yaml
    mode: "0640"
  notify: Restart k3s

- name: Install k3s
  ansible.builtin.shell: |
    curl -sfL https://get.k3s.io | sh -
  environment:
    INSTALL_K3S_EXEC: "{{ k3s_role }}"
    {{ (k3s_version | length > 0) | ternary({'INSTALL_K3S_VERSION': k3s_version}, {}) }}
  args:
    creates: /usr/local/bin/k3s
  when: k3s_needs_install

- name: Ensure k3s service state
  ansible.builtin.service:
    name: "{{ k3s_service_name }}"
    state: "{{ 'started' if k3s_state == 'present' else 'stopped' }}"
    enabled: "{{ k3s_state == 'present' }}"
  when: k3s_service.stat.exists or k3s_bin.stat.exists