---
# showcase/k3scluster-deploy-instance.yml — Per-instance tasks for k3scluster
#
# Called from k3scluster-post-deploy.yml in a loop over ffsdn_instances.
# The 'instance' loop var has: name, ip, component_name, image_alias, type
# Dispatches to k3s-control.yml or k3s-worker.yml based on component_name.

- name: Set instance facts from loop variable
  ansible.builtin.set_fact:
    ffsdn_instance_name: "{{ instance.name }}"
    ffsdn_instance_ip: "{{ instance.ip | default('') }}"
    component_name: "{{ instance.component_name }}"

- name: "Wait for {{ ffsdn_instance_name }} to be running (up to 60s)"
  ansible.builtin.uri:
    url: "{{ incus_api }}/1.0/instances/{{ ffsdn_instance_name }}/state"
    method: GET
    client_cert: "{{ incus_cert }}"
    client_key: "{{ incus_key }}"
    validate_certs: false
    return_content: true
  register: instance_state
  until: instance_state.json.metadata.status == "Running"
  retries: 12
  delay: 5

- name: Validate component
  ansible.builtin.assert:
    that:
      - component_name in valid_components
    fail_msg: >-
      Unknown component '{{ component_name }}' for k3scluster blueprint.
      Instance '{{ ffsdn_instance_name }}' component must be one of: {{ valid_components | join(', ') }}.

- name: Display dispatch info
  ansible.builtin.debug:
    msg: "K3scluster {{ component_name }} — configuring {{ ffsdn_instance_name }}"

- name: Enable security.nesting and raise resource limits for K3s
  ansible.builtin.uri:
    url: "{{ incus_api }}/1.0/instances/{{ ffsdn_instance_name }}"
    method: PATCH
    client_cert: "{{ incus_cert }}"
    client_key: "{{ incus_key }}"
    validate_certs: false
    body_format: json
    body:
      config:
        security.nesting: "true"
        security.syscalls.intercept.mknod: "true"
        security.syscalls.intercept.setxattr: "true"
        limits.processes: "4096"
        limits.memory: "4GiB"
        limits.cpu: "2"
    status_code: [200, 202]
    return_content: true
  register: nesting_result

- name: Wait for nesting config if async
  ansible.builtin.uri:
    url: "{{ incus_api }}{{ nesting_result.json.operation }}/wait?timeout=30"
    method: GET
    client_cert: "{{ incus_cert }}"
    client_key: "{{ incus_key }}"
    validate_certs: false
    return_content: true
  when: nesting_result.status == 202

- name: Restart container to apply security and resource config
  ansible.builtin.uri:
    url: "{{ incus_api }}/1.0/instances/{{ ffsdn_instance_name }}/state"
    method: PUT
    client_cert: "{{ incus_cert }}"
    client_key: "{{ incus_key }}"
    validate_certs: false
    body_format: json
    body:
      action: restart
      timeout: 30
    status_code: [200, 202]
    return_content: true
  register: restart_result

- name: Wait for restart to complete
  ansible.builtin.uri:
    url: "{{ incus_api }}{{ restart_result.json.operation }}/wait?timeout=60"
    method: GET
    client_cert: "{{ incus_cert }}"
    client_key: "{{ incus_key }}"
    validate_certs: false
    return_content: true
  when: restart_result.status == 202

- name: Wait for container to be running after restart (up to 30s)
  ansible.builtin.uri:
    url: "{{ incus_api }}/1.0/instances/{{ ffsdn_instance_name }}/state"
    method: GET
    client_cert: "{{ incus_cert }}"
    client_key: "{{ incus_key }}"
    validate_certs: false
    return_content: true
  register: post_restart_state
  until: post_restart_state.json.metadata.status == "Running"
  retries: 6
  delay: 5

- name: Run common setup tasks
  ansible.builtin.include_tasks: common.yml

- name: Route to component-specific tasks
  ansible.builtin.include_tasks: "k3s-{{ component_name }}.yml"

- name: Remove temporary internet NIC
  ansible.builtin.include_tasks: remove-setup-nic.yml

- name: Record deployment in ledger
  ansible.builtin.lineinfile:
    path: /tmp/awx-deploy-ledger.log
    line: >-
      {{ lookup('pipe', 'date -Iseconds') }}
      SHOWCASE-DEPLOY instance={{ ffsdn_instance_name }}
      blueprint=k3scluster component={{ component_name }}
      ip={{ ffsdn_instance_ip }}
      cluster={{ ffsdn_cluster_name | default('unknown') }}
      status=success
    create: true
    mode: "0644"