---
- name: Configure Flatcar host and install K3s
  hosts: k3s_servers
  become: true
  gather_facts: true

  vars:
    k3s_version: "v1.30.6+k3s1"
    k3s_install_url: "https://get.k3s.io"
    k3s_api_server_port: 6443

  pre_tasks:
    - name: Require Flatcar Linux
      ansible.builtin.assert:
        that:
          - ansible_distribution == "Flatcar"
        fail_msg: "This playbook expects Flatcar Linux. Use the Ubuntu fallback playbook if needed."

  tasks:
    - name: Disable swap if a swap device is present
      ansible.builtin.command: swapoff -a
      changed_when: false
      failed_when: false

    - name: Set restrictive SSH authentication
      ansible.builtin.copy:
        dest: /etc/ssh/sshd_config.d/60-k8s-baseline.conf
        owner: root
        group: root
        mode: '0644'
        content: |
          PasswordAuthentication no
          PermitRootLogin no
      notify: Restart sshd

    - name: Create K3s configuration directory
      ansible.builtin.file:
        path: /etc/rancher/k3s
        state: directory
        owner: root
        group: root
        mode: '0750'

    - name: Configure K3s for Cilium kube-proxy replacement
      ansible.builtin.copy:
        dest: /etc/rancher/k3s/config.yaml
        owner: root
        group: root
        mode: '0600'
        content: |
          write-kubeconfig-mode: "0600"
          flannel-backend: none
          disable-network-policy: true
          disable-kube-proxy: true
          disable:
            - traefik
          https-listen-port: {{ k3s_api_server_port }}

    - name: Download pinned K3s installer
      ansible.builtin.get_url:
        url: "{{ k3s_install_url }}"
        dest: /var/lib/rancher/k3s-install.sh
        owner: root
        group: root
        mode: '0700'

    - name: Install pinned K3s server
      ansible.builtin.command:
        cmd: /var/lib/rancher/k3s-install.sh server
        creates: /usr/local/bin/k3s
      environment:
        INSTALL_K3S_VERSION: "{{ k3s_version }}"

    - name: Enable and start K3s
      ansible.builtin.systemd:
        name: k3s
        state: started
        enabled: true
        daemon_reload: true

    - name: Wait for K3s API port
      ansible.builtin.wait_for:
        host: 127.0.0.1
        port: "{{ k3s_api_server_port }}"
        timeout: 120

  handlers:
    - name: Restart sshd
      ansible.builtin.systemd:
        name: sshd
        state: restarted