- name: Deploy Wikideck
  hosts: alpha-control-plane
  become: true
  vars_files:
    - ~/Desktop/secrets.yaml
  pre_tasks:
    - name: Require an explicitly approved, immutable mainnet release
      ansible.builtin.assert:
        that:
          - wikideck_mainnet_deployment_approved | default(false) | bool
          - wikideck_release_image is defined and wikideck_release_image is string and wikideck_release_image is match('^.+@sha256:[a-f0-9]{64}$')
          - wikideck_mainnet_peers is defined and wikideck_mainnet_peers is sequence and wikideck_mainnet_peers is not string and wikideck_mainnet_peers | length >= 2
          - wikideck_mainnet_peers | unique | list | length == wikideck_mainnet_peers | length
          - wikideck_candidate_chain_id is defined and wikideck_candidate_chain_id is match('^[a-f0-9]{64}$')
          - wikideck_candidate_risk_ack | default('') == 'operator-accepts-unaudited-risk'
          - wikideck_release_genesis_time is defined and (wikideck_release_genesis_time | string) is match('^[1-9][0-9]{8,10}$')
          - wikideck_release_genesis_time | int >= 1700000000 and wikideck_release_genesis_time | int <= 4102444800
          - wikideck_release_genesis_time | int <= ansible_date_time.epoch | int
        fail_msg: >-
          Mainnet is currently NO-GO. Do not deploy until the operator has approved
          a digest-pinned image with a verified frozen manifest, arrived genesis,
          at least two independent public HTTPS peers, and explicit risk acceptance.
  roles:
    - role: ericomeehan.wikideck
      vars:
        wikideck_image: "{{ wikideck_release_image }}"
        wikideck_image_pull_policy: IfNotPresent
        wikideck_peers: "{{ wikideck_mainnet_peers }}"
        wikideck_mainnet_launch: "{{ wikideck_candidate_chain_id }}"
        wikideck_mainnet_risk_ack: "{{ wikideck_candidate_risk_ack }}"
        wikideck_public_origin: https://wikideck.eom.dev
        wikideck_ingress_enabled: true
        wikideck_ingress_host: wikideck.eom.dev
        wikideck_ingress_class_name: nginx
        wikideck_ingress_annotations:
          cert-manager.io/cluster-issuer: ca-issuer
        # Match the actual ingress controller namespace; add its podSelector if known.
        wikideck_network_policy_ingress_from:
          - namespaceSelector:
              matchLabels:
                kubernetes.io/metadata.name: ingress-nginx
        wikideck_storage_size: 2Ti
        wikideck_storage_class: nfs-client
        # Populate only after confirming the real proxy source IPs/CIDRs.
        wikideck_trusted_proxies: "{{ wikideck_ingress_proxy_sources | default([]) }}"