---
- name: Validate Owncast identity and service settings
  ansible.builtin.assert:
    that:
      - owncast_namespace is match('^[a-z0-9]([-a-z0-9]*[a-z0-9])?$')
      - owncast_namespace | length <= 63
      - owncast_name is match('^[a-z]([-a-z0-9]*[a-z0-9])?$')
      - owncast_name | length <= 63
      - owncast_pvc_name is match('^[a-z0-9]([-a-z0-9.]*[a-z0-9])?$')
      - owncast_pvc_name | length <= 253
      - owncast_image | length > 0
      - owncast_service_type in ['ClusterIP', 'NodePort', 'LoadBalancer']
      - owncast_external_traffic_policy in ['Local', 'Cluster']
      - owncast_image_pull_policy in ['Always', 'IfNotPresent', 'Never']
      - owncast_resources is mapping
      - owncast_service_annotations is mapping
      - owncast_ingress_annotations is mapping
      - owncast_load_balancer_source_ranges is sequence
      - owncast_load_balancer_source_ranges is not string
    fail_msg: Invalid Owncast resource identity, image, resources, or service settings.

- name: Validate Owncast ingress settings
  ansible.builtin.assert:
    that:
      - owncast_hostname | length > 0
      - owncast_hostname | length <= 253
      - owncast_hostname is match('^[a-z0-9]([a-z0-9-]*[a-z0-9])?(\.[a-z0-9]([a-z0-9-]*[a-z0-9])?)*$')
      - not (owncast_tls_enabled | bool) or owncast_tls_secret_name | length > 0
      - owncast_cluster_issuer | length == 0 or owncast_tls_enabled | bool
    fail_msg: Ingress requires a DNS hostname and, for TLS, a secret name. An issuer requires TLS.
  when: owncast_ingress_enabled | bool