---
# ─── K3S CLUSTER PROVISIONING: Debian 12 ─────────────────────────────────────

- name: Preparar nodos K3s (Debian)
  hosts: k3s_cluster
  gather_facts: no
  become: yes
  tasks:
    - name: Esperar a que el nodo esté listo (SSH activo)
      ansible.builtin.wait_for_connection:
        delay: 5
        timeout: 300

    - name: Recopilar facts de los nodos
      ansible.builtin.setup:

    - name: Instalar dependencias básicas (incluye dependencias de Longhorn)
      ansible.builtin.apt:
        name:
          - curl
          - ca-certificates
          - open-iscsi
          - nfs-common
        state: present
        update_cache: yes

    - name: Desactivar IPv6 completamente en los nodos (sysctl)
      ansible.builtin.sysctl:
        name: "{{ item }}"
        value: '1'
        state: present
        reload: yes
      loop:
        - net.ipv6.conf.all.disable_ipv6
        - net.ipv6.conf.default.disable_ipv6
        - net.ipv6.conf.lo.disable_ipv6
      ignore_errors: yes

    - name: Configurar Servidores DNS IPv4 en los nodos (8.8.8.8 y 1.1.1.1)
      ansible.builtin.copy:
        content: |
          nameserver 8.8.8.8
          nameserver 1.1.1.1
        dest: /etc/resolv.conf
        mode: '0644'

    - name: Asegurar que el servicio iscsid esté activo (Requisito Longhorn)
      ansible.builtin.systemd:
        name: iscsid
        state: started
        enabled: yes

    - name: Crear directorio de configuración de K3s
      ansible.builtin.file:
        path: /etc/rancher/k3s
        state: directory
        mode: '0755'

    - name: Configurar Registries Insecure (HTTP) para K3s (containerd)
      ansible.builtin.copy:
        content: |
          mirrors:
            "192.168.1.78:3000":
              endpoint:
                - "http://192.168.1.78:3000"
        dest: /etc/rancher/k3s/registries.yaml
        mode: '0644'

- name: Instalar y configurar el K3s Master
  hosts: k3s_master
  become: yes
  tasks:
    - name: Instalar K3s Server (Master)
      ansible.builtin.shell: |
        curl -sfL https://get.k3s.io | sh -
      args:
        creates: /usr/local/bin/k3s

    - name: Esperar a que se genere el node-token del clúster
      ansible.builtin.wait_for:
        path: /var/lib/rancher/k3s/server/node-token
        timeout: 60

    - name: Obtener el node-token del Master
      ansible.builtin.command: cat /var/lib/rancher/k3s/server/node-token
      register: k3s_token_cmd
      changed_when: false

    - name: Guardar el token en memoria para los Workers
      ansible.builtin.set_fact:
        k3s_token: "{{ k3s_token_cmd.stdout | trim }}"

    - name: Obtener contenido de kubeconfig del Master
      ansible.builtin.slurp:
        src: /etc/rancher/k3s/k3s.yaml
      register: kubeconfig_base64

    - name: Guardar kubeconfig localmente con la IP correcta
      ansible.builtin.copy:
        content: "{{ (kubeconfig_base64.content | b64decode) | replace('127.0.0.1', ansible_host) }}"
        dest: "./kubeconfig"
        mode: '0600'
      delegate_to: localhost
      become: no

    # ─── BOOTSTRAP DE ARGOCD ─────────────────────────────────────────────────
    - name: Crear namespace para ArgoCD
      ansible.builtin.shell: |
        /usr/local/bin/kubectl create namespace argocd --dry-run=client -o yaml | /usr/local/bin/kubectl apply -f -
      register: ns_create
      changed_when: "'created' in ns_create.stdout"

    - name: Instalar ArgoCD usando el manifiesto oficial
      ansible.builtin.shell: |
        /usr/local/bin/kubectl apply --server-side --force-conflicts -n argocd -f https://raw.githubusercontent.com/argoproj/argo-cd/stable/manifests/install.yaml
      register: argocd_install
      changed_when: "'configured' in argocd_install.stdout or 'created' in argocd_install.stdout or 'serverside-applied' in argocd_install.stdout"

    - name: Configurar ArgoCD en modo HTTP seguro tras proxy Traefik
      ansible.builtin.shell: |
        /usr/local/bin/kubectl patch configmap argocd-cmd-params-cm -n argocd --type merge -p '{"data":{"server.insecure":"true"}}'

    - name: Exponer ArgoCD mediante Ingress en Traefik (Previene Error 404)
      ansible.builtin.shell: |
        cat <<EOF | /usr/local/bin/kubectl apply -f -
        apiVersion: networking.k8s.io/v1
        kind: Ingress
        metadata:
          name: argocd-server-ingress
          namespace: argocd
        spec:
          ingressClassName: traefik
          rules:
          - http:
              paths:
              - path: /
                pathType: Prefix
                backend:
                  service:
                    name: argocd-server
                    port:
                      number: 80
        EOF

    # ─── DESPLIEGUE DE LONGHORN ───────────────────────────────────────────────
    - name: Desplegar almacenamiento distribuido Longhorn
      ansible.builtin.shell: |
        /usr/local/bin/kubectl apply -f https://raw.githubusercontent.com/longhorn/longhorn/v1.7.2/deploy/longhorn.yaml
      register: longhorn_install
      changed_when: "'configured' in longhorn_install.stdout or 'created' in longhorn_install.stdout"

    # ─── DESPLIEGUE DE SEALED SECRETS ─────────────────────────────────────────
    - name: Desplegar controlador Bitnami Sealed Secrets
      ansible.builtin.shell: |
        /usr/local/bin/kubectl apply -f https://github.com/bitnami-labs/sealed-secrets/releases/download/v0.28.0/controller.yaml
      register: sealed_secrets_install
      changed_when: "'configured' in sealed_secrets_install.stdout or 'created' in sealed_secrets_install.stdout"

    # ─── BOOTSTRAP DE GITOPS (APP OF APPS) ───────────────────────────────────
    - name: Desplegar GitOps Root Application en ArgoCD
      ansible.builtin.shell: |
        /usr/local/bin/kubectl apply -f /home/anibalos/Documents/telco-gitops-manifests/root-application.yaml
      ignore_errors: yes

- name: Instalar y configurar K3s Workers
  hosts: k3s_workers
  become: yes
  tasks:
    - name: Instalar K3s Agent (Workers) y unir al clúster
      ansible.builtin.shell: |
        curl -sfL https://get.k3s.io | K3S_URL="https://{{ hostvars[groups['k3s_master'][0]]['ansible_host'] }}:6443" K3S_TOKEN="{{ hostvars[groups['k3s_master'][0]]['k3s_token'] }}" sh -
      args:
        creates: /usr/local/bin/k3s-agent