prole/infrastructure/playbooks/site.yml

---
# Runbook tiers (systemd-like startup ordering):
#   1) boot / kernel
#   2) storage: iscsi auth, iscsi login
#   3) filesystem mount
#   4) OS configuration (e.g., samba)
#   5) OS package installation (k3s)
#   6) OS package configuration (helm/kubectl apply)
#
# This playbook is intentionally ordered so each tier fully completes before
# moving on to the next tier.

- name: Tier 1 - Boot / kernel (cgroups)
  hosts: k3s_hosts
  gather_facts: false
  become: true
  serial: 1
  pre_tasks:
    - name: Gather minimal facts
      ansible.builtin.setup:
        gather_subset:
          - min
  roles:
    - cgroups

- name: Tier 1.5 - Quiesce k3s and detach migrated iSCSI LUNs (myrddin)
  hosts: myrddin.prole.org
  gather_facts: false
  become: true
  pre_tasks:
    - name: Gather minimal facts
      ansible.builtin.setup:
        gather_subset:
          - min
  tasks:
    - name: Check if k3s systemd unit exists
      ansible.builtin.stat:
        path: /etc/systemd/system/k3s.service
      register: _k3s_unit

    - name: Stop k3s (quiesce before iSCSI detach)
      ansible.builtin.systemd:
        name: k3s
        state: stopped
      when:
        - not ansible_check_mode
        - _k3s_unit.stat.exists | default(false)
        - (iscsi_absent_mounts | default([]) | length) > 0 or (iscsi_absent_targets | default([]) | length) > 0

    - name: Detach migrated iSCSI targets/mounts (best-effort cleanup)
      ansible.builtin.import_role:
        name: iscsi
        tasks_from: detach
      when:
        - (iscsi_absent_mounts | default([]) | length) > 0 or (iscsi_absent_targets | default([]) | length) > 0

- name: Tier 2 - Storage (iSCSI auth/login)
  hosts: iscsi
  gather_facts: false
  become: true
  pre_tasks:
    - name: Gather minimal facts
      ansible.builtin.setup:
        gather_subset:
          - min
  tasks:
    - name: iSCSI auth/login
      ansible.builtin.import_role:
        name: iscsi
        tasks_from: login

- name: Tier 3 - Filesystem mounts (iSCSI)
  hosts: iscsi
  gather_facts: false
  become: true
  pre_tasks:
    - name: Gather minimal facts
      ansible.builtin.setup:
        gather_subset:
          - min
  tasks:
    - name: iSCSI mounts
      ansible.builtin.import_role:
        name: iscsi
        tasks_from: mount

- name: Tier 4 - OS configuration (Pi-hole DNS and resilience)
  hosts: pihole
  gather_facts: false
  become: true
  tags:
    - pihole
  pre_tasks:
    - name: Gather minimal facts
      ansible.builtin.setup:
        gather_subset:
          - min
  roles:
    - pihole_dns

- name: Tier 4 - OS configuration (Samba AD DNS reverse zones and PTRs)
  hosts: ad_dc
  gather_facts: false
  become: true
  tags:
    - samba
  pre_tasks:
    - name: Gather minimal facts
      ansible.builtin.setup:
        gather_subset:
          - min
  roles:
    - samba_ad_dc
    - samba_dns
    - samba_reverse_dns

- name: Tier 4 - OS configuration (base linux)
  hosts: linux_hosts
  gather_facts: false
  become: true
  pre_tasks:
    - name: Gather minimal facts
      ansible.builtin.setup:
        gather_subset:
          - min
  roles:
    - role: netplan_static
      when: netplan_static_enabled | default(false) | bool
    - local_user
    - rsyslog
    - prole

- name: Tier 4.1 - OS configuration (Prole SSL certs)
  hosts: ssl_hosts
  gather_facts: false
  become: true
  pre_tasks:
    - name: Gather minimal facts
      ansible.builtin.setup:
        gather_subset:
          - min
  roles:
    - prole_ssl

- name: Tier 4 - OS configuration (console dashboard)
  hosts: k3s_hosts
  gather_facts: false
  become: true
  pre_tasks:
    - name: Gather minimal facts
      ansible.builtin.setup:
        gather_subset:
          - min
  roles:
    - dashboard

- name: Tier 4.5 - Database (MariaDB primary)
  hosts: mariadb_primary
  gather_facts: false
  become: true
  serial: 1
  pre_tasks:
    - name: Gather minimal facts
      ansible.builtin.setup:
        gather_subset:
          - min
  roles:
    - mariadb_primary

- name: Tier 4.6 - Database (MariaDB replica)
  hosts: mariadb_replica
  gather_facts: false
  become: true
  serial: 1
  pre_tasks:
    - name: Gather minimal facts
      ansible.builtin.setup:
        gather_subset:
          - min
  roles:
    - mariadb_replica

- name: Tier 5 - OS package installation (k3s)
  hosts: k3s_hosts
  gather_facts: false
  become: true
  serial: 1
  tags: [k3s]
  pre_tasks:
    - name: Gather minimal facts
      ansible.builtin.setup:
        gather_subset:
          - min
  tasks:
    - name: Install and start k3s
      ansible.builtin.import_role:
        name: k3s
        tasks_from: install

- name: Tier 5.5 - Kubernetes node operations (labels)
  hosts: k3s_servers
  gather_facts: false
  become: true
  serial: 1
  pre_tasks:
    - name: Gather minimal facts
      ansible.builtin.setup:
        gather_subset:
          - min
  tasks:
    - name: Persist Kubernetes node labels (post-provisioning)
      ansible.builtin.import_role:
        name: k3s
        tasks_from: label_nodes
      when: (k3s_node_labels | default({}) | length) > 0

- name: Tier 6 - OS package configuration (helm/kubectl apply)
  hosts: k3s_hosts
  gather_facts: false
  become: true
  serial: 1
  tags: [k3s]
  pre_tasks:
    - name: Gather minimal facts
      ansible.builtin.setup:
        gather_subset:
          - min
  tasks:
    - name: Configure k3s add-ons
      ansible.builtin.import_role:
        name: k3s
        tasks_from: configure