---
# Converges one app (one loop iteration of `app` from playbooks/k3s.yml) to
# the state its k3s_apps: entry asks for.
#
# `state: present` (the default) deploys; `state: absent` tears down. Same
# explicit-removal rule as compose_stack, and for the same reason: Ansible
# keeps no record of what it deployed last run, so deleting an app from
# `k3s_apps:` only stops the loop visiting it — the workload keeps running,
# unmanaged, until something says `absent`. The entry stays as a tombstone.
#
# Unlike compose_stack, removal here does tear the workload down completely
# on the first pass, because k3s's deploy controller owns the resources a
# manifest created and garbage-collects them when the file goes away. What
# it does *not* touch, by the same "a default teardown should be
# reversible" reasoning compose_stack applies: the app's database, its
# PersistentVolumeClaims, and its Vault path.

- name: Set app facts
  ansible.builtin.set_fact:
    app_local_dir: "{{ repo_root }}/src/{{ app.src }}"
    app_state: "{{ app.state | default('present') }}"

- name: Validate requested app state
  ansible.builtin.assert:
    that: app_state in ['present', 'absent']
    fail_msg: >-
      App '{{ app.name }}' has state '{{ app_state }}'; expected 'present'
      or 'absent'.
    quiet: true

- name: Deploy app
  ansible.builtin.include_tasks: deploy.yml
  when: app_state == 'present'

- name: Remove app
  ansible.builtin.include_tasks: remove.yml
  when: app_state == 'absent'