---
- name: Update k3s vault token on controller
  block:
    - name: Set vault k3s path
      ansible.builtin.set_fact:
        vault_k3s_path: "{{ role_path }}/../../inventory/group_vars/all/vault_k3s.yml"
        vault_pass_default: "{{ role_path }}/../../../.vault_pass"

    - name: Determine vault password file
      ansible.builtin.set_fact:
        k3s_vault_password_file: >-
          {{ k3s_vault_password_file
             | default(lookup('env', 'ANSIBLE_VAULT_PASSWORD_FILE') | default('', true), true) }}
      delegate_to: localhost
      delegate_facts: true

    - name: Check for default vault password file
      ansible.builtin.stat:
        path: "{{ vault_pass_default }}"
      register: vault_pass_default_stat
      delegate_to: localhost

    - name: Fallback to default vault password file
      ansible.builtin.set_fact:
        k3s_vault_password_file: "{{ vault_pass_default }}"
      when:
        - (hostvars['localhost'].k3s_vault_password_file | default('')) | length == 0
        - vault_pass_default_stat.stat.exists
      delegate_to: localhost
      delegate_facts: true

    - name: Check if vault file is encrypted
      ansible.builtin.command: "head -n 1 {{ vault_k3s_path }}"
      register: vault_k3s_head
      changed_when: false
      delegate_to: localhost
      failed_when: false

    - name: Mark vault encryption state
      ansible.builtin.set_fact:
        vault_k3s_encrypted: "{{ (vault_k3s_head.stdout | default('')) is search('^\\$ANSIBLE_VAULT') }}"
      delegate_to: localhost
      delegate_facts: true

    - name: Decrypt vault_k3s.yml
      ansible.builtin.command: >-
        ansible-vault decrypt {{ vault_k3s_path }}
        --vault-password-file {{ hostvars['localhost'].k3s_vault_password_file }}
      changed_when: true
      delegate_to: localhost
      when:
        - hostvars['localhost'].vault_k3s_encrypted | default(false)
        - (hostvars['localhost'].k3s_vault_password_file | default('')) | length > 0

    - name: Update vault k3s token
      ansible.builtin.lineinfile:
        path: "{{ vault_k3s_path }}"
        regexp: '^vault_k3s_token:'
        line: "vault_k3s_token: \"{{ k3s_token_discovered }}\""
        create: true
        mode: "0644"
      delegate_to: localhost

    - name: Encrypt vault_k3s.yml
      ansible.builtin.command: >-
        ansible-vault encrypt {{ vault_k3s_path }}
        --vault-password-file {{ hostvars['localhost'].k3s_vault_password_file }}
      changed_when: true
      delegate_to: localhost
      when:
        - hostvars['localhost'].vault_k3s_encrypted | default(false)
        - (hostvars['localhost'].k3s_vault_password_file | default('')) | length > 0
  run_once: true