---
# Tears one app off the cluster: delete the manifests it was deployed from
# and let k3s's deploy controller garbage-collect what they created.
#
# This is the one place k3s is *less* work than Compose. `compose_stack`
# has to run `docker compose down` and therefore needs the compose file to
# still be on disk to know what it's tearing down (which is why removing an
# app there is a two-pass job — see CLAUDE.md → "Removing an app"). Here the
# deploy controller already tracks which resources each manifest file
# created, via the Addon CR it writes alongside them, so deleting the file
# is the teardown. src/<app>/ can be deleted in the same commit.
#
# Deliberately *not* removed, same reasoning as compose_stack's opt-in
# flags — a default teardown should be reversible:
#
#   - the app's database and role on the shared Postgres
#   - its PersistentVolumeClaims (the app's manifests own those; if the
#     chart's PVCs carry a Helm ownership annotation they go with the
#     HelmChart CR, so check `kubectl -n <ns> get pvc` after)
#   - its Vault path
#   - the namespace, which the secrets manifest below creates but the
#     controller will only remove if nothing else landed in it
#
# There's no `remove_database`/`remove_volumes` equivalent yet. Add one the
# day it's actually wanted rather than guessing at the shape now.

- name: Find the app's Kubernetes manifest templates
  ansible.builtin.set_fact:
    app_manifest_templates: >-
      {{ query('fileglob',
               app_local_dir ~ '/ansible/' ~ k3s_app_platform_dir ~ '/*.yaml.j2')
         | sort }}

# The secrets manifest first, then the app's own. Order is cosmetic — the
# controller reconciles each file's removal independently — but removing the
# workload's namespace/Secret last would leave pods briefly running without
# the credentials they were started with, and losing them noisily in a log
# is worse than losing them quietly.
- name: Remove the app's Kubernetes manifests
  ansible.builtin.file:
    path: >-
      {{ k3s_manifests_dir }}/{{ app.name }}-{{
         item | basename | regex_replace('\.j2$', '') }}
    state: absent
  loop: "{{ app_manifest_templates }}"
  become: true

- name: Remove the app namespace and secrets manifest
  ansible.builtin.file:
    path: "{{ k3s_manifests_dir }}/{{ app.name }}-secrets.yaml"
    state: absent
  become: true

- name: Report what removal left behind
  ansible.builtin.debug:
    msg: >-
      App '{{ app.name }}' manifests removed; k3s will garbage-collect the
      resources they created. Its database, PVCs and Vault path were left
      alone on purpose — remove those by hand if the teardown is meant to be
      permanent.