---
- name: Ensure k3s config exists
  ansible.builtin.stat:
    path: /etc/rancher/k3s/config.yaml
  register: k3s_config

- name: Fail when k3s config is missing
  ansible.builtin.debug:
    msg: "k3s config missing at /etc/rancher/k3s/config.yaml; creating minimal config for sync."
  when: not k3s_config.stat.exists

- name: Ensure k3s config directory exists when missing
  ansible.builtin.file:
    path: /etc/rancher/k3s
    state: directory
    owner: root
    group: "{{ k3s_kubeconfig_group | default('kubeadm') }}"
    mode: "0750"
  when: not k3s_config.stat.exists

- name: Create minimal k3s config when missing
  ansible.builtin.copy:
    dest: /etc/rancher/k3s/config.yaml
    owner: root
    group: "{{ k3s_kubeconfig_group | default('kubeadm') }}"
    mode: "0640"
    content: |
      {% if k3s_cluster_init | default(false) | bool %}
      cluster-init: true
      {% elif k3s_server_url | default('') %}
      server: "{{ k3s_server_url }}"
      {% endif %}
      {% if k3s_sync_token | default('') %}
      token: "{{ k3s_sync_token }}"
      {% endif %}
  when: not k3s_config.stat.exists

- name: Sync k3s token into config
  ansible.builtin.lineinfile:
    path: /etc/rancher/k3s/config.yaml
    regexp: "^token:"
    line: "token: \"{{ k3s_sync_token }}\""
    owner: root
    group: "{{ k3s_kubeconfig_group | default('kubeadm') }}"
    mode: "0640"

- name: Load registry defaults from prole.cfg
  ansible.builtin.set_fact:
    k3s_prole_k3s_server_cfg: "{{ lookup('ansible.builtin.ini', 'PROLE_K3S_SERVER section=Global file=' + playbook_dir + '/../../conf/prole.cfg', default='') }}"
    k3s_prole_service_namespace_cfg: "{{ lookup('ansible.builtin.ini', 'SERVICE_NAMESPACE section=Global file=' + playbook_dir + '/../../conf/prole.cfg', default='') }}"
  when: k3s_registry_config_enabled | bool

- name: Resolve k3s registry host
  ansible.builtin.set_fact:
    k3s_registry_host_resolved: >-
      {{ (k3s_registry_host | default('')) if (k3s_registry_host | default('') | length > 0)
         else (k3s_prole_k3s_server_cfg | default('')) if (k3s_prole_k3s_server_cfg | default('') | length > 0)
         else inventory_hostname }}
  when: k3s_registry_config_enabled | bool

- name: Normalize k3s registry host
  ansible.builtin.set_fact:
    k3s_registry_host_resolved: "{{ k3s_registry_host_resolved | regex_replace('^https?://', '') | regex_replace('/.*$', '') | regex_replace(':.*$', '') }}"
  when: k3s_registry_config_enabled | bool

- name: Resolve k3s registry namespace
  ansible.builtin.set_fact:
    k3s_registry_namespace_resolved: >-
      {{ (k3s_registry_namespace | default('')) if (k3s_registry_namespace | default('') | length > 0 and k3s_registry_namespace != '${SERVICE_NAMESPACE}')
         else (k3s_prole_service_namespace_cfg | default('')) if (k3s_prole_service_namespace_cfg | default('') | length > 0 and k3s_prole_service_namespace_cfg != '${SERVICE_NAMESPACE}')
         else 'default' }}
  when: k3s_registry_config_enabled | bool

- name: Validate k3s registry host
  ansible.builtin.assert:
    that:
      - k3s_registry_host_resolved | length > 0
    fail_msg: "k3s registry host could not be resolved (set k3s_registry_host or PROLE_K3S_SERVER)."
  when: k3s_registry_config_enabled | bool

- name: Render k3s registries config
  ansible.builtin.template:
    src: registries.yaml.j2
    dest: "{{ k3s_registry_config_path }}"
    mode: "0644"
  when: k3s_registry_config_enabled | bool

- name: Ensure k3s server directory exists
  ansible.builtin.file:
    path: /var/lib/rancher/k3s/server
    state: directory
    mode: "0755"
  when: k3s_sync_tls_bundle_present | default(false)

- name: Remove existing k3s tls directory before sync
  ansible.builtin.file:
    path: /var/lib/rancher/k3s/server/tls
    state: absent
  when: k3s_sync_tls_bundle_present | default(false)

- name: Restore k3s tls bundle
  ansible.builtin.unarchive:
    src: "{{ k3s_sync_tls_bundle }}"
    dest: /var/lib/rancher/k3s/server
    owner: root
    group: root
  when: k3s_sync_tls_bundle_present | default(false)