---
k3s_enabled: true
k3s_state: present
k3s_version: ""
k3s_guard_token_drift: true

# k3s reset workflow
# By default, cleanup/uninstall is local-only. The `k3s_reset` playbook enables
# cluster-side node removal explicitly.
k3s_reset_force_cluster_node_delete: false
k3s_reset_kubeconfig_path: /etc/rancher/k3s/k3s.yaml

# k3s service startup can be slow on first boot (image pulls, containerd unpacking, etc.).
# The service task is best-effort and then Ansible polls `systemctl is-active` using these knobs.
k3s_service_start_retries: 60
k3s_service_start_delay: 5

# Destructive repair/refresh workflow (server only)
# A refresh wipes the k3s installation/state to a blank slate but preserves the
# join token and CA material so existing agents can rejoin without changing the token.
k3s_refresh_backup_root: /root/k3s-refresh-backups
k3s_refresh_confirm: ""
k3s_refresh_run_configure: true

# CloudNative-PG
# Pin operator/plugin version by default to avoid unanticipated upgrades and load spikes.
# Upgrades must be explicitly enabled via `k3s_cnpg_upgrade: true`.
k3s_cnpg_version_default: "1.28.1"
k3s_cnpg_upgrade: false

k3s_role: agent
k3s_cluster_init: false
k3s_server_url: ""
k3s_token: "{{ vault_k3s_token | default('') }}"
# Optional: if `k3s_token` is a full node-token (`K10...::server:...`), set this
# to the raw secret (`...` after `::server:`) for the server config.
k3s_server_token: ""
k3s_disable: []
k3s_tls_sans: []
k3s_service_node_labels: []
k3s_node_taints: []
k3s_disable_agent: false

# K3s state storage
# `/var/lib/rancher` is treated as local host storage (not iSCSI/shared).
k3s_rancher_mountpoint: /var/lib/rancher
k3s_rancher_storage_class: local
k3s_data_dir: "{{ k3s_rancher_mountpoint }}/k3s"

# Guardrail: when enabled, k3s must not run unless `k3s_rancher_mountpoint` is a
# dedicated mount (i.e. not backed by the same device as `/`).
#
# This is intentionally opt-in because some nodes may legitimately run k3s with
# `/var/lib/rancher` on the root filesystem.
k3s_rancher_mount_required: false

# If `k3s_rancher_mount_required` is true, these must be set to manage the mount
# via Ansible (/etc/fstab + mount).
k3s_rancher_mount_src: ""
k3s_rancher_mount_fstype: ""
k3s_rancher_mount_opts: "noatime"
k3s_rancher_mount_passno: 2

k3s_write_kubeconfig_mode: "0640"
k3s_kubeconfig_group: kubeadm
k3s_kubeconfig_users: []

k3s_registry_config_enabled: true
k3s_registry_config_path: /etc/rancher/k3s/registries.yaml
k3s_registry_host: ""
k3s_registry_namespace: ""
k3s_registry_port: 5000
# Internal Prole registry is HTTP by default; set to "https" when TLS is configured.
k3s_registry_endpoint_scheme: "http"

# Pulling large images on every run can cause major load spikes; keep this opt-in.
k3s_prestage_images: false
k3s_prestage_images_platform: "linux/arm64"
k3s_prestage_images_list:
  - docker.io/library/registry:2
  - docker.io/prom/prometheus:v2.55.1
  - docker.io/prom/alertmanager:v0.27.0
  - quay.io/prometheus/node-exporter:v1.8.2
  - quay.io/prometheus-operator/prometheus-operator:v0.71.2
  - ghcr.io/openbao/openbao:2.0.0
  - ghcr.io/opentofu/opentofu:1.8.2
  - docker.io/library/kong:3.8

k3s_cert_manager_version: "v1.19.4"
k3s_service_hostname: "{{ SERVICE_HOSTNAME | default('svc.prole.org') }}"
k3s_service_cert_name: "{{ k3s_service_hostname | replace('.', '-') }}"
k3s_service_tls_secret_name: "{{ k3s_service_cert_name }}-tls"
k3s_service_cluster_issuer: "letsencrypt-prod"

# Host firewall: keep svc.prole.org reachable even when Tailscale inserts
# restrictive filter rules (e.g., `ts-input`/REJECT) near the top of `INPUT`.
# This role installs a small systemd oneshot that re-applies the rules at boot.
k3s_firewall_svc_allow_enabled: true
k3s_firewall_svc_allow_chain: "PROLE-SVC-ALLOW"
k3s_firewall_svc_allow_tcp_ports:
  - 80
  - 443
  # Traefik NodePorts observed on k3s; keep configurable.
  - 31936
  - 32370

# Legacy alias (svc-check used to own svc.prole.org). Keep for backward compatibility.
k3s_svc_check_domain: "{{ k3s_service_hostname }}"
k3s_svc_check_namespace: "svc-check"
k3s_svc_check_kong_namespace: "${SERVICE_NAMESPACE}"
k3s_svc_check_kong_configmap_name: "prole-svc-kong-config"
k3s_kong_namespace: "${SERVICE_NAMESPACE}"
k3s_kong_deployment: "prole-svc-kong"