---
# Adjusts the Traefik k3s installs for itself, rather than installing
# anything: a HelmChartConfig merged over k3s's own Traefik HelmChart, plus —
# only when the dashboard is being published on a hostname — the
# Certificate/Middleware/IngressRoute trio that puts it behind Authentik.
# See defaults/main.yml and templates/traefik.helmchartconfig.yaml.j2.
#
# Same delivery mechanism as every other k3s_* role: template a file into
# /var/lib/rancher/k3s/server/manifests/ and let k3s's bundled helm-controller
# and deploy controller reconcile it. No helm binary, kubeconfig or extra
# collection on the controller.

- name: Fail fast if the dashboard would be exposed without authentication
  when: k3s_traefik_dashboard_host | length > 0
  ansible.builtin.assert:
    that:
      - k3s_traefik_dashboard_auth_address | length > 0
    fail_msg: >-
      k3s_traefik_dashboard_host is set but k3s_traefik_dashboard_auth_address
      is empty — set both in inventory/group_vars/k3s_cluster.yml, or neither.
      Publishing the dashboard without the forward-auth middleware would put a
      read-only view of every router, service and middleware on this cluster
      on the LAN unauthenticated, so this refuses rather than defaulting to an
      address that might not be Authentik.
    quiet: true
  run_once: true

- name: Deploy the Traefik HelmChartConfig
  ansible.builtin.template:
    src: traefik.helmchartconfig.yaml.j2
    dest: /var/lib/rancher/k3s/server/manifests/traefik-config.yaml
    owner: root
    group: root
    mode: "0644"
  become: true

- name: Deploy the exposed dashboard route
  when: k3s_traefik_dashboard_host | length > 0
  ansible.builtin.template:
    src: dashboard-ingressroute.yaml.j2
    dest: /var/lib/rancher/k3s/server/manifests/traefik-dashboard.yaml
    owner: root
    group: root
    mode: "0644"
  become: true

# Clearing k3s_traefik_dashboard_host is a teardown, not just a stop-managing:
# k3s's deploy controller garbage-collects the objects a manifest created when
# the manifest is removed, so deleting this file withdraws the public route,
# its middleware and its certificate. Same reasoning as roles/k3s_app's
# removal path — with the difference that this one needs no `state: absent`
# tombstone, because the hostname is a single value rather than a list entry
# that could be silently dropped.
- name: Withdraw the exposed dashboard route when no host is configured
  when: k3s_traefik_dashboard_host | length == 0
  ansible.builtin.file:
    path: /var/lib/rancher/k3s/server/manifests/traefik-dashboard.yaml
    state: absent
  become: true