---
# rn-lab-host-01: Docker Engine (TLS config comes from the docker-tls role, run before this
# one), the egress proxy + monitoring agents compose stack, kernel prerequisites for nested
# k3s in privileged Lab containers, and Docker daemon storage/limits configuration.

- name: Install Docker Engine
  ansible.builtin.import_tasks: "{{ role_path }}/../common/tasks/docker-engine.yml"

- name: Kernel prerequisites for nested k3s (privileged containers)
  ansible.posix.sysctl:
    name: "{{ item.name }}"
    value: "{{ item.value }}"
    sysctl_set: true
    state: present
    reload: true
  loop:
    - { name: net.ipv4.ip_forward, value: "1" }
    - { name: fs.inotify.max_user_watches, value: "524288" }   # k3s/kubelet watch a lot of files
    - { name: fs.inotify.max_user_instances, value: "512" }
    - { name: vm.max_map_count, value: "262144" }               # matches upstream k3s/etcd guidance

- name: Ensure cgroup v2 controllers needed by nested k3s are available
  ansible.builtin.command: cat /sys/fs/cgroup/cgroup.controllers
  register: cgroup_controllers
  changed_when: false
  failed_when: false

- name: Warn if cgroup v2 controllers look incomplete (informational only)
  ansible.builtin.debug:
    msg: >-
      cgroup.controllers reports: {{ cgroup_controllers.stdout | default('unreadable') }}.
      Expect at least cpu, memory, pids, io for reliable nested k3s — verify manually if any
      are missing (see docs/PRODUCTION_VALIDATION_CHECKLIST.md "Lab boot" section).
  when: cgroup_controllers.rc == 0

- name: Create data/config directories
  ansible.builtin.file:
    path: "{{ item }}"
    state: directory
    owner: root
    group: docker
    mode: "0750"
  loop:
    - /opt/rootnode/lab-host
    - "{{ rootnode_data_root }}/lab-work"   # disposable — see docs/BACKUP_DR.md, never backed up

- name: Render production docker-compose.yml
  ansible.builtin.template:
    src: "{{ role_path }}/../../../docker/lab-host/docker-compose.production.yml"
    dest: /opt/rootnode/lab-host/docker-compose.yml
    owner: root
    group: root
    mode: "0640"
  notify: restart rootnode-lab-host

- name: Deploy systemd unit
  ansible.builtin.template:
    src: rootnode-lab-host.service.j2
    dest: /etc/systemd/system/rootnode-lab-host.service
    mode: "0644"
  notify: restart rootnode-lab-host

- name: Enable and start rootnode-lab-host
  ansible.builtin.systemd:
    name: rootnode-lab-host
    enabled: true
    state: started
    daemon_reload: true

# Storage-driver/networking daemon options live in the docker-tls role's daemon.json.j2 —
# Docker only ever reads ONE /etc/docker/daemon.json, so that's the single source of truth for
# this host's whole daemon config, not just its TLS settings (see that role's template).