---
- name: Delete k3s nodes and remove cluster token from vault
  hosts: k3s_hosts
  become: true
  tasks:
    - name: Remove existing k3s installation and data
      ansible.builtin.import_role:
        name: k3s
        tasks_from: cleanup

- name: Remove k3s token from Ansible vault
  hosts: localhost
  connection: local
  gather_facts: false
  vars:
    vault_k3s_path: "{{ playbook_dir }}/../inventory/group_vars/all/vault_k3s.yml"
    k3s_vault_password_file: "{{ lookup('env', 'ANSIBLE_VAULT_PASSWORD_FILE') | default('', true) }}"
  tasks:
    - name: Require vault password file for token deletion
      ansible.builtin.assert:
        that:
          - k3s_vault_password_file is defined
          - k3s_vault_password_file | length > 0
        fail_msg: "Set k3s_vault_password_file to a vault password file path."

    - name: Ensure vault file exists
      ansible.builtin.stat:
        path: "{{ vault_k3s_path }}"
      register: vault_k3s_file

    - name: Fail when vault file is missing
      ansible.builtin.fail:
        msg: "Vault file not found at {{ vault_k3s_path }}"
      when: not vault_k3s_file.stat.exists

    - name: Read vault_k3s.yml header
      ansible.builtin.command: "head -n 1 {{ vault_k3s_path }}"
      register: vault_k3s_header
      changed_when: false

    - name: Mark vault_k3s.yml encryption state
      ansible.builtin.set_fact:
        vault_k3s_encrypted: "{{ vault_k3s_header.stdout is search('^\\$ANSIBLE_VAULT') }}"

    - name: Decrypt vault_k3s.yml
      ansible.builtin.command: >-
        ansible-vault decrypt {{ vault_k3s_path }}
        --vault-password-file {{ k3s_vault_password_file }}
      changed_when: true
      when: vault_k3s_encrypted | bool

    - name: Remove vault_k3s_token entry
      ansible.builtin.lineinfile:
        path: "{{ vault_k3s_path }}"
        regexp: '^vault_k3s_token:'
        state: absent

    - name: Encrypt vault_k3s.yml
      ansible.builtin.command: >-
        ansible-vault encrypt {{ vault_k3s_path }}
        --vault-password-file {{ k3s_vault_password_file }}
      changed_when: true
      when: vault_k3s_encrypted | bool