---
- name: Deploy Wikideck
  hosts: localhost
  connection: local
  gather_facts: true
  pre_tasks:
    - name: Require an approved and ready mainnet candidate release
      ansible.builtin.assert:
        that:
          - wikideck_mainnet_deployment_approved | default(false) | bool
          - wikideck_release_image is defined and wikideck_release_image is string and wikideck_release_image is match('^.+@sha256:[a-f0-9]{64}$')
          - wikideck_release_peers is defined and wikideck_release_peers is sequence and wikideck_release_peers is not string and wikideck_release_peers | length >= 2
          - wikideck_release_peers | unique | list | length == wikideck_release_peers | length
          - wikideck_candidate_chain_id is defined and wikideck_candidate_chain_id is match('^[a-f0-9]{64}$')
          - wikideck_candidate_risk_ack | default('') == 'operator-accepts-unaudited-risk'
          - wikideck_release_genesis_time is defined and (wikideck_release_genesis_time | string) is match('^[1-9][0-9]{8,10}$')
          - wikideck_release_genesis_time | int >= 1700000000 and wikideck_release_genesis_time | int <= 4102444800
          - wikideck_release_genesis_time | int <= ansible_date_time.epoch | int
        fail_msg: >-
          Mainnet is currently NO-GO. Supply only an approved digest-pinned image,
          verified frozen manifest and arrived genesis, independent public HTTPS
          peers, and explicit unaudited-risk acceptance.
  roles:
    - role: wikideck
      vars:
        wikideck_image: "{{ wikideck_release_image }}"
        wikideck_image_pull_policy: IfNotPresent
        wikideck_peers: "{{ wikideck_release_peers }}"
        wikideck_mainnet_launch: "{{ wikideck_candidate_chain_id }}"
        wikideck_mainnet_risk_ack: "{{ wikideck_candidate_risk_ack }}"
        wikideck_ingress_enabled: true
        wikideck_ingress_host: wikideck.example.com
        wikideck_public_origin: https://wikideck.example.com
        wikideck_ingress_class_name: nginx
        wikideck_ingress_annotations:
          cert-manager.io/cluster-issuer: letsencrypt-prod
          nginx.ingress.kubernetes.io/ssl-redirect: "true"
        wikideck_network_policy_ingress_from:
          - namespaceSelector:
              matchLabels:
                kubernetes.io/metadata.name: ingress-nginx