---

- name: Skip k3s configuration when state is absent
  ansible.builtin.meta: end_host
  when: k3s_state == "absent"

- name: Set k3s service name
  ansible.builtin.set_fact:
    k3s_service_name: "{{ 'k3s' if k3s_role == 'server' else 'k3s-agent' }}"

- name: Pre-stage critical images (registry:2, kong, etc.)
  ansible.builtin.include_tasks: prestage_images.yml
  when:
    - k3s_state == "present"
    - k3s_prestage_images | bool
  tags: [images]

- name: Create monitoring directory on pi.prole.org
  ansible.builtin.file:
    path: /var/lib/rancher/monitoring
    state: directory
    mode: "0777"
  when:
    - k3s_state == "present"
    - inventory_hostname == 'pi.prole.org'

- name: Apply pi-local-iscsi StorageClass
  ansible.builtin.shell: |
    k3s kubectl apply -f - <<'EOF'
    apiVersion: storage.k8s.io/v1
    kind: StorageClass
    metadata:
      name: pi-local-iscsi
    provisioner: rancher.io/local-path
    volumeBindingMode: WaitForFirstConsumer
    reclaimPolicy: Retain
    parameters:
      nodePathMap: |
        [
          {
            "node": "pi.prole.org",
            "paths": ["/var/lib/rancher/monitoring"]
          }
        ]
    EOF
  register: _pi_local_iscsi_apply
  changed_when: "'configured' in _pi_local_iscsi_apply.stdout or 'created' in _pi_local_iscsi_apply.stdout"
  when:
    - k3s_state == "present"
    - k3s_role == 'server'
  run_once: true

- name: Fetch kubeconfig to controller for controller-side installs
  ansible.builtin.include_tasks: fetch_kubeconfig.yml
  when:
    - k3s_state == "present"
    - k3s_role == 'server'
  run_once: true

- name: Ensure CloudNative-PG operator and kubectl plugin
  ansible.builtin.include_tasks: cnpg.yml
  when: k3s_state == "present"

- name: Ensure cert-manager is installed for ACME
  ansible.builtin.include_tasks: certmgr.yml
  when:
    - k3s_state == "present"
    - k3s_role == 'server'

- name: Configure ACME issuer and certificate for svc.prole.org
  ansible.builtin.include_tasks: acme_cert.yml
  when:
    - k3s_state == "present"
    - k3s_role == 'server'

- name: Ensure Kong is present and refreshed
  ansible.builtin.include_tasks: kong.yml
  when:
    - k3s_state == "present"
    - k3s_role == 'server'

- name: Deploy svc.prole.org check site through Kong
  ansible.builtin.include_tasks: svc_check.yml
  when:
    - k3s_state == "present"
    - k3s_role == 'server'

- name: Reload Kong declarative config (only when changed)
  ansible.builtin.include_tasks: kong_restart.yml
  when:
    - k3s_state == "present"
    - k3s_role == 'server'