---
# Deploy the official ESS OCI chart on a K3s node.
# Pre-tasks create the non-secret values files on the target host.
# The matrix_stack role then validates and deploys the chart.
- name: Deploy the Matrix stack (ESS OCI chart)
  hosts: matrix
  become: true
  gather_facts: false
  serial: 1
  pre_tasks:
    - name: Ensure the ESS values directory exists
      ansible.builtin.file:
        path: /etc/ess
        state: directory
        owner: root
        group: root
        mode: "0700"

    - name: Write hostnames values file
      ansible.builtin.copy:
        dest: /etc/ess/hostnames.yaml
        owner: root
        group: root
        mode: "0600"
        content: |
          serverName: {{ matrix_server_name }}

          elementWeb:
            ingress:
              host: {{ matrix_element_host }}

          synapse:
            ingress:
              host: {{ matrix_synapse_host }}

          matrixAuthenticationService:
            ingress:
              host: {{ matrix_mas_host }}

          elementAdmin:
            ingress:
              host: {{ matrix_admin_host }}

          matrixRTC:
            ingress:
              host: {{ matrix_rtc_host }}

    - name: Write TLS values file
      ansible.builtin.copy:
        dest: /etc/ess/tls.yaml
        owner: root
        group: root
        mode: "0600"
        content: |
          certManager:
            clusterIssuer: letsencrypt-prod
          ingress:
            className: traefik
            tlsEnabled: true

    - name: Write single-node tuning values file
      ansible.builtin.copy:
        dest: /etc/ess/single-node.yaml
        owner: root
        group: root
        mode: "0600"
        content: |
          # ESS single-node resource tuning for K3s
          # Chart defaults are already single-node-friendly
          postgres:
            storage:
              size: 20Gi
          redis:
            maxMemory: 128mb
          matrixRTC:
            enabled: false

    - name: Verify values files are in place
      ansible.builtin.stat:
        path: "/etc/ess/{{ item }}"
      loop:
        - hostnames.yaml
        - tls.yaml
        - single-node.yaml
      register: _values_check

    - name: Assert all values files exist
      ansible.builtin.assert:
        that:
          - item.stat.exists
          - item.stat.isreg
          - item.stat.pw_name == 'root'
      loop: "{{ _values_check.results }}"
      loop_control:
        label: "{{ item.stat.path | default(item.item) }}"

  roles:
    - role: matrix_stack
      tags: [matrix, stack, mutating]