---
- name: Require explicit approval before cert-manager reconciliation
  ansible.builtin.assert:
    that:
      - cert_manager_enabled | bool
    fail_msg: >-
      Refusing cert-manager changes. Re-run with cert_manager_enabled=true after
      confirming public TCP 80 and 443 reach Traefik.

- name: Require Helm and the K3s kubeconfig
  ansible.builtin.stat:
    path: "{{ item }}"
  loop:
    - /usr/local/bin/helm
    - "{{ cert_manager_kubeconfig }}"
  register: cert_manager_prerequisites

- name: Assert Helm and kubeconfig are available
  ansible.builtin.assert:
    that:
      - item.stat.exists
    fail_msg: "Missing cert-manager prerequisite: {{ item.item }}"
  loop: "{{ cert_manager_prerequisites.results }}"

- name: Add or update the Jetstack Helm repository
  ansible.builtin.command:
    argv:
      - helm
      - repo
      - add
      - "{{ cert_manager_chart_repository_name }}"
      - "{{ cert_manager_chart_repository_url }}"
      - --force-update
  environment:
    KUBECONFIG: "{{ cert_manager_kubeconfig }}"
  changed_when: false

- name: Update Helm repositories
  ansible.builtin.command:
    argv: [helm, repo, update]
  environment:
    KUBECONFIG: "{{ cert_manager_kubeconfig }}"
  changed_when: false

- name: Install or reconcile cert-manager
  ansible.builtin.command:
    argv:
      - helm
      - upgrade
      - --install
      - "{{ cert_manager_release_name }}"
      - "{{ cert_manager_chart_ref }}"
      - --namespace
      - "{{ cert_manager_namespace }}"
      - --create-namespace
      - --version
      - "{{ cert_manager_chart_version }}"
      - --set
      - crds.enabled=true
      - --wait
      - --timeout
      - 10m
  environment:
    KUBECONFIG: "{{ cert_manager_kubeconfig }}"
  changed_when: true

- name: Install ClusterIssuer manifest without secret material
  ansible.builtin.template:
    src: clusterissuer.yaml.j2
    dest: "/etc/rancher/k3s/{{ cert_manager_cluster_issuer_name }}-clusterissuer.yaml"
    owner: root
    group: root
    mode: "0600"

- name: Apply ClusterIssuer manifest
  ansible.builtin.command:
    argv:
      - k3s
      - kubectl
      - apply
      - -f
      - "/etc/rancher/k3s/{{ cert_manager_cluster_issuer_name }}-clusterissuer.yaml"
  changed_when: false

- name: Wait for ClusterIssuer readiness
  ansible.builtin.command:
    argv:
      - k3s
      - kubectl
      - wait
      - --for=condition=Ready
      - "clusterissuer/{{ cert_manager_cluster_issuer_name }}"
      - --timeout=180s
  changed_when: false