---
- name: Ensure cert-manager CRDs exist for ACME
  ansible.builtin.command: k3s kubectl get crd certificates.cert-manager.io
  register: k3s_acme_crd
  changed_when: false
  failed_when: k3s_acme_crd.rc != 0
  run_once: true

- name: Set ACME contact email (defaults to admin@prole.org)
  ansible.builtin.set_fact:
    svc_check_acme_email: "{{ letsencrypt_email | default('admin@prole.org') }}"
  run_once: true

- name: Ensure namespace exists for ACME certificate secret
  ansible.builtin.shell: |
    k3s kubectl apply -f - <<'EOF'
    apiVersion: v1
    kind: Namespace
    metadata:
      name: {{ k3s_svc_check_kong_namespace }}
    EOF
  args:
    executable: /bin/bash
  run_once: true

- name: Configure ACME ClusterIssuer and Certificate for svc.prole.org
  ansible.builtin.shell: |
    k3s kubectl apply -f - <<'EOF'
    apiVersion: cert-manager.io/v1
    kind: ClusterIssuer
    metadata:
      name: letsencrypt-prod
    spec:
      acme:
        email: {{ svc_check_acme_email }}
        server: https://acme-v02.api.letsencrypt.org/directory
        privateKeySecretRef:
          name: letsencrypt-prod
        solvers:
          - http01:
              ingress:
                class: traefik
    ---
    apiVersion: cert-manager.io/v1
    kind: Certificate
    metadata:
      name: svc-prole-org
      namespace: {{ k3s_svc_check_kong_namespace }}
    spec:
      secretName: svc-prole-org-tls
      issuerRef:
        name: letsencrypt-prod
        kind: ClusterIssuer
      dnsNames:
        - {{ k3s_svc_check_domain }}
    EOF
  args:
    executable: /bin/bash
  run_once: true