---
# Runbook tiers (systemd-like startup ordering):
#   1) boot / kernel
#   2) storage: iscsi auth, iscsi login
#   3) filesystem mount
#   4) OS configuration (e.g., samba)
#   5) OS package installation (k3s)
#   6) OS package configuration (helm/kubectl apply)
#
# This playbook is intentionally ordered so each tier fully completes before
# moving on to the next tier.

- name: Tier 1 - Boot / kernel (cgroups)
  hosts: k3s_hosts
  gather_facts: false
  become: true
  serial: 1
  pre_tasks:
    - name: Gather minimal facts
      ansible.builtin.setup:
        gather_subset:
          - min
  roles:
    - cgroups

- name: Tier 2 - Storage (iSCSI auth/login)
  hosts: iscsi
  gather_facts: false
  become: true
  pre_tasks:
    - name: Gather minimal facts
      ansible.builtin.setup:
        gather_subset:
          - min
  tasks:
    - name: iSCSI auth/login
      ansible.builtin.import_role:
        name: iscsi
        tasks_from: login

- name: Tier 3 - Filesystem mounts (iSCSI)
  hosts: iscsi
  gather_facts: false
  become: true
  pre_tasks:
    - name: Gather minimal facts
      ansible.builtin.setup:
        gather_subset:
          - min
  tasks:
    - name: iSCSI mounts
      ansible.builtin.import_role:
        name: iscsi
        tasks_from: mount

- name: Tier 4 - OS configuration (Pi-hole DNS and resilience)
  hosts: pihole
  gather_facts: false
  become: true
  pre_tasks:
    - name: Gather minimal facts
      ansible.builtin.setup:
        gather_subset:
          - min
  roles:
    - pihole_dns

- name: Tier 4 - OS configuration (Samba AD DNS reverse zones and PTRs)
  hosts: ad_dc
  gather_facts: false
  become: true
  pre_tasks:
    - name: Gather minimal facts
      ansible.builtin.setup:
        gather_subset:
          - min
  roles:
    - samba_ad_dc
    - samba_dns
    - samba_reverse_dns

- name: Tier 4 - OS configuration (base linux)
  hosts: linux_hosts
  gather_facts: false
  become: true
  pre_tasks:
    - name: Gather minimal facts
      ansible.builtin.setup:
        gather_subset:
          - min
  roles:
    - role: netplan_static
      when: netplan_static_enabled | default(false) | bool
    - local_user
    - rsyslog
    - prole

- name: Tier 4 - OS configuration (console dashboard)
  hosts: k3s_hosts
  gather_facts: false
  become: true
  pre_tasks:
    - name: Gather minimal facts
      ansible.builtin.setup:
        gather_subset:
          - min
  roles:
    - dashboard

- name: Tier 4.5 - Database (MariaDB primary)
  hosts: mariadb_primary
  gather_facts: false
  become: true
  serial: 1
  pre_tasks:
    - name: Gather minimal facts
      ansible.builtin.setup:
        gather_subset:
          - min
  roles:
    - mariadb_primary

- name: Tier 4.6 - Database (MariaDB replica)
  hosts: mariadb_replica
  gather_facts: false
  become: true
  serial: 1
  pre_tasks:
    - name: Gather minimal facts
      ansible.builtin.setup:
        gather_subset:
          - min
  roles:
    - mariadb_replica

- name: Tier 5 - OS package installation (k3s)
  hosts: k3s_hosts
  gather_facts: false
  become: true
  serial: 1
  pre_tasks:
    - name: Gather minimal facts
      ansible.builtin.setup:
        gather_subset:
          - min
  tasks:
    - name: Install and start k3s
      ansible.builtin.import_role:
        name: k3s
        tasks_from: install

- name: Tier 6 - OS package configuration (helm/kubectl apply)
  hosts: k3s_hosts
  gather_facts: false
  become: true
  serial: 1
  pre_tasks:
    - name: Gather minimal facts
      ansible.builtin.setup:
        gather_subset:
          - min
  tasks:
    - name: Configure k3s add-ons
      ansible.builtin.import_role:
        name: k3s
        tasks_from: configure