---
# Top-level playbook — full production/staging deployment. Idempotent: re-running against an
# already-deployed host converges it, doesn't rebuild from scratch (Phase 4 §20 requirement).
#
# Usage:
#   ansible-playbook site.yml -i inventory/production.ini --vault-password-file .vault_pass
#   ansible-playbook site.yml -i inventory/staging.ini -e env=staging
#
# Role order matters: firewall and docker-tls must land before platform/lab-host bring up
# services that depend on the network policy / TLS material already being in place.

- name: Base hardening — all RootNode hosts
  hosts: rootnode
  become: true
  roles:
    - common

- name: Firewall policy — all RootNode hosts
  hosts: rootnode
  become: true
  roles:
    - firewall

- name: Docker TLS — both hosts (server cert on lab_host, client cert on platform)
  hosts: rootnode
  become: true
  roles:
    - docker-tls

- name: Deploy the Platform VM
  hosts: platform
  become: true
  roles:
    - platform

- name: Deploy the Lab Host VM
  hosts: lab_host
  become: true
  roles:
    - lab-host

- name: Deploy monitoring configuration — both hosts
  hosts: rootnode
  become: true
  roles:
    - monitoring-agent

- name: Deploy backup automation — Platform VM only (that's where Postgres lives)
  hosts: platform
  become: true
  roles:
    - backup