---
- name: Prepare MariaDB datastore for k3s (create DB/user/grants)
  hosts: k3s_hosts
  gather_facts: false
  become: false
  serial: 1
  vars:
    k3s_mariadb_host: "{{ k3s_datastore_mariadb_host | default('synology.prole.org') }}"
    k3s_mariadb_port: "{{ k3s_datastore_mariadb_port | default(3306) }}"
    k3s_mariadb_db: "{{ k3s_datastore_mariadb_db | default('k3s') }}"
    k3s_mariadb_user: "{{ k3s_datastore_mariadb_user | default('prole_k3s') }}"
    k3s_mariadb_user_password: "{{ k3s_datastore_mariadb_password | default('') }}"

    # MariaDB admin credentials (must be stored in Ansible Vault by the operator)
    k3s_mariadb_admin_user: "{{ k3s_mariadb_admin_user | default('root') }}"
    k3s_mariadb_admin_password: "{{ k3s_mariadb_admin_password | default('') }}"

    # Where to allow the k3s user to connect from (tighten this if possible)
    k3s_mariadb_user_host: "{{ k3s_mariadb_user_host | default('%') }}"

  pre_tasks:
    - name: Only run on k3s server nodes
      ansible.builtin.meta: end_host
      when: k3s_role | default('') != 'server'

    - name: Require k3s MariaDB user password (vaulted)
      ansible.builtin.assert:
        that:
          - k3s_mariadb_user_password | length > 0
        fail_msg: >-
          k3s_mariadb_user_password is empty. Ensure k3s_datastore_mariadb_password is set
          (and sourced from Ansible Vault, e.g. vault_samba_dns_admin_pass).

    - name: Require MariaDB admin password for non-check runs
      ansible.builtin.assert:
        that:
          - k3s_mariadb_admin_password | length > 0
        fail_msg: >-
          k3s_mariadb_admin_password is empty.
          Provide a vaulted MariaDB admin password (e.g. in an encrypted group_vars/*/vault.yml).
      when: not ansible_check_mode

    - name: Verify mysql client is available on this host
      ansible.builtin.command: mysql --version
      changed_when: false

  tasks:
    - name: Create k3s database (if missing)
      ansible.builtin.command: >-
        mysql
        --protocol=tcp
        --host={{ k3s_mariadb_host }}
        --port={{ k3s_mariadb_port }}
        --user={{ k3s_mariadb_admin_user }}
        --execute="CREATE DATABASE IF NOT EXISTS `{{ k3s_mariadb_db }}`"
      environment:
        MYSQL_PWD: "{{ k3s_mariadb_admin_password }}"
      changed_when: false
      when: not ansible_check_mode
      no_log: true

    - name: Create/ensure k3s MariaDB user exists
      ansible.builtin.command: >-
        mysql
        --protocol=tcp
        --host={{ k3s_mariadb_host }}
        --port={{ k3s_mariadb_port }}
        --user={{ k3s_mariadb_admin_user }}
        --execute="CREATE USER IF NOT EXISTS '{{ k3s_mariadb_user }}'@'{{ k3s_mariadb_user_host }}' IDENTIFIED BY '{{ k3s_mariadb_user_password }}'"
      environment:
        MYSQL_PWD: "{{ k3s_mariadb_admin_password }}"
      changed_when: false
      when: not ansible_check_mode
      no_log: true

    - name: Grant admin privileges on k3s database to k3s MariaDB user
      ansible.builtin.command: >-
        mysql
        --protocol=tcp
        --host={{ k3s_mariadb_host }}
        --port={{ k3s_mariadb_port }}
        --user={{ k3s_mariadb_admin_user }}
        --execute="GRANT ALL PRIVILEGES ON `{{ k3s_mariadb_db }}`.* TO '{{ k3s_mariadb_user }}'@'{{ k3s_mariadb_user_host }}'"
      environment:
        MYSQL_PWD: "{{ k3s_mariadb_admin_password }}"
      changed_when: false
      when: not ansible_check_mode
      no_log: true

    - name: Flush privileges
      ansible.builtin.command: >-
        mysql
        --protocol=tcp
        --host={{ k3s_mariadb_host }}
        --port={{ k3s_mariadb_port }}
        --user={{ k3s_mariadb_admin_user }}
        --execute="FLUSH PRIVILEGES"
      environment:
        MYSQL_PWD: "{{ k3s_mariadb_admin_password }}"
      changed_when: false
      when: not ansible_check_mode
      no_log: true