---
- hosts:
    - master
    - worker
  become: true
  gather_facts: true
  any_errors_fatal: true
  pre_tasks:
    - name: Pausing for 5 seconds...
      ansible.builtin.pause:
        seconds: 5
  tasks:
    - name: Locale
      block:
        - name: Locale | Set timezone
          community.general.timezone:
            name: "{{ timezone | default('Etc/UTC') }}"

    - name: Networking
      block:
        - name: Networking | Set hostname to inventory hostname
          ansible.builtin.hostname:
            name: "{{ inventory_hostname }}"
        - name: Networking | Update /etc/hosts to include inventory hostname
          ansible.builtin.blockinfile:
            path: /etc/hosts
            block: |
              127.0.1.1   {{ inventory_hostname }}

    - name: Packages | Fedora
      block:
        - name: Packages | Install required packages
          ansible.builtin.dnf:
            name: "{{ fedora.packages | default([]) }}"
            state: present
            update_cache: true
        - name: Packages | Remove leaf packages
          ansible.builtin.dnf:
            autoremove: true
      when: ansible_facts['distribution'] == 'Fedora'

    - name: Packages | Ubuntu
      block:
        - name: Packages | Install required packages
          ansible.builtin.apt:
            name: "{{ ubuntu.packages | default([]) }}"
            state: present
            update_cache: true
        - name: Packages | Remove leaf packages
          ansible.builtin.apt:
            autoremove: true
        - name: Packages | RasPi packages
          ansible.builtin.apt:
            name: ["linux-modules-extra-raspi"]
            install_recommends: false
          notify: Reboot
          when: "'raspi' in ansible_kernel"
      when: ansible_facts['distribution'] == 'Ubuntu'

    - name: Packages | Cilium CLI
      ansible.builtin.include_role:
        name: githubixx.cilium_cli
        public: true
      vars:
        cilium_cli_arch: "{{ 'amd64' if ansible_architecture == 'x86_64' else 'arm64' }}"
        cilium_cli_tmp_directory: /tmp
      when:
        - k3s_control_node is defined
        - k3s_control_node

    - name: User Configuration
      block:
        - name: User Configuration | Add additional SSH public keys
          ansible.posix.authorized_key:
            user: "{{ ansible_user }}"
            key: "{{ item }}"
          loop: "{{ public_ssh_keys | default([]) }}"

    - name: System Configuration (1)
      block:
        - name: System Configuration (1) | Disable firewalld | Fedora
          ansible.builtin.systemd:
            service: firewalld.service
            enabled: false
            masked: true
            state: stopped
          when: ansible_facts['distribution'] == 'Fedora'
        - name: System Configuration (1) | Disable ufw | Ubuntu
          ansible.builtin.systemd:
            service: ufw.service
            enabled: false
            masked: true
            state: stopped
          when: ansible_facts['distribution'] == 'Ubuntu'
        - name: System Configuration (1) | Enable fstrim
          ansible.builtin.systemd:
            service: fstrim.timer
            enabled: true

    - name: System Configuration (2)
      block:
        - name: System Configuration (2) | Enable kernel modules now
          community.general.modprobe:
            name: "{{ item }}"
            state: present
          loop: [br_netfilter, ip_vs, ip_vs_rr, overlay, rbd]
        - name: System Configuration (2) | Enable kernel modules on boot
          ansible.builtin.copy:
            mode: 0644
            content: "{{ item }}"
            dest: "/etc/modules-load.d/{{ item }}.conf"
          loop: [br_netfilter, ip_vs, ip_vs_rr, overlay, rbd]
        - name: System Configuration (2) | Set sysctls
          ansible.posix.sysctl:
            name: "{{ item.key }}"
            value: "{{ item.value }}"
            sysctl_file: /etc/sysctl.d/99-kubernetes.conf
            reload: true
          with_dict: "{{ sysctl_config }}"
          vars:
            sysctl_config:
              net.ipv4.ip_forward: 1
              net.ipv4.conf.all.forwarding: 1
              net.ipv4.conf.all.rp_filter: 0
              net.ipv4.conf.default.rp_filter: 0
              net.ipv6.conf.all.forwarding: 1
              net.bridge.bridge-nf-call-iptables: 1
              net.bridge.bridge-nf-call-ip6tables: 1
              fs.inotify.max_user_watches: 524288
              fs.inotify.max_user_instances: 512
        - name: System Configuration (2) | Disable swap | Fedora
          ansible.builtin.dnf:
            name: zram-generator-defaults
            state: absent
          when: ansible_facts['distribution'] == 'Fedora'
        - name: System Configuration (2) | Disable swap at runtime | Ubuntu
          ansible.builtin.command: swapoff -a
          when:
            - ansible_facts['distribution'] == 'Ubuntu'
            - ansible_swaptotal_mb > 0
        - name: System Configuration (2) | Disable swap at boot | Ubuntu
          ansible.posix.mount:
            name: "{{ item }}"
            fstype: swap
            state: absent
          loop: ["none", "swap"]
          when: ansible_facts['distribution'] == 'Ubuntu'
        - name: System Configuration (2) | Permissive SELinux | Fedora
          ansible.posix.selinux:
            state: permissive
            policy: targeted
          when: ansible_facts['distribution'] == 'Fedora'
      notify: Reboot

  handlers:
    - name: Reboot
      ansible.builtin.reboot:
        msg: Rebooting nodes
        reboot_timeout: 3600