---
# Deploys the shared Postgres cluster onto k3s: install CloudNativePG (the
# operator) via a HelmChart CR, then define the actual cluster as a plain
# Cluster CR — same two-manifest pattern as roles/k3s_metallb (chart CR +
# plain config manifest), for the same reason: k3s's deploy controller
# retries a manifest referencing CRDs the HelmChart above hasn't installed
# yet instead of failing outright, so the Cluster CR doesn't need to wait on
# the operator chart finishing first.
#
# Config is layered the same way compose_stack/lxc_app layer an app's
# common/vars.yml + platform vars.yml — src/shared/postgres/ is the same
# shared service already used on Unraid/Proxmox, just deployed a third way
# here. Secrets come from the same Vault path those platforms already use
# (homelab/shared/postgres) — this is a separate physical instance, but
# reuses the path rather than inventing a k3s-specific one, same "one path
# per app-concept" convention as every other stack.

- name: Set shared-postgres source facts
  ansible.builtin.set_fact:
    pg_local_dir: "{{ repo_root }}/src/shared/postgres"

- name: Load portable shared-postgres variables
  ansible.builtin.include_vars:
    file: "{{ pg_local_dir }}/common/vars.yml"
    name: pg_common_vars

- name: Load Kubernetes-specific shared-postgres variables
  ansible.builtin.include_vars:
    file: "{{ pg_local_dir }}/ansible/kubernetes/vars.yml"
    name: pg_platform_vars

- name: Merge shared-postgres configuration
  ansible.builtin.set_fact:
    pg_config: >-
      {{ (pg_common_vars.env_defaults | default({}))
         | combine(pg_platform_vars.env_defaults | default({})) }}

- name: Look up shared-postgres superuser credentials from Vault
  ansible.builtin.set_fact:
    pg_vault_secrets: >-
      {{ lookup('community.hashi_vault.vault_kv2_get',
                 k3s_postgres_vault_path,
                 engine_mount_point=vault_kv_mount,
                 url=vault_addr,
                 auth_method=vault_auth_method,
                 role_id=vault_role_id | default(omit),
                 secret_id=vault_secret_id | default(omit)).secret }}
  no_log: true

- name: Deploy the CloudNativePG operator HelmChart manifest
  ansible.builtin.template:
    src: cnpg-operator.helmchart.yaml.j2
    dest: /var/lib/rancher/k3s/server/manifests/cnpg-operator.yaml
    owner: root
    group: root
    mode: "0644"
  become: true

# Namespace + Cluster CR, no secrets — safe to render even though the
# Cluster CR references the Secret below, for the same "later file, retried
# reconcile" reasoning as the Secret referencing this file's Namespace.
- name: Deploy the shared-postgres Cluster manifest
  ansible.builtin.template:
    src: postgres-cluster.yaml.j2
    dest: /var/lib/rancher/k3s/server/manifests/shared-postgres-cluster.yaml
    owner: root
    group: root
    mode: "0644"
  become: true

# Separate file (and mode) from the Cluster manifest above purely because
# this one carries the Vault-sourced password — everything else here is safe
# at 0644, this one isn't.
#
# The dest filename deliberately doesn't track the Secret's own name, which
# gained a `-vault` suffix (see the template's header for why). k3s's deploy
# controller records which resources each manifest *file* created and prunes
# the ones that disappear from it, so renaming the Secret inside this same
# file makes the old `shared-postgres-superuser` object get garbage-collected
# on the next run. Renaming the file too would orphan it instead: Ansible
# doesn't remove files it no longer writes, so the old manifest would sit
# there keeping the stale Secret alive.
- name: Deploy the shared-postgres superuser Secret
  ansible.builtin.template:
    src: postgres-superuser-secret.yaml.j2
    dest: /var/lib/rancher/k3s/server/manifests/shared-postgres-superuser-secret.yaml
    owner: root
    group: root
    mode: "0600"
  become: true
  no_log: true