# SPDX-License-Identifier: MIT-0
---
- name: Validate required variables
  ansible.builtin.assert:
    that:
      - ess_server_name | length > 0
      - ess_registry_username | length > 0
      - ess_registry_token | length > 0
      - ess_rtc_external_ip | length > 0
    fail_msg: >-
      Required variables are missing. Provide ess_server_name,
      ess_registry_username, ess_registry_token (OpenBao) and
      ess_rtc_external_ip in group_vars/ess_servers.yml.
    quiet: true

- name: Validate ess_rtc_external_ip looks like an IP address
  ansible.builtin.assert:
    that:
      # IPv4 dotted-quad or IPv6 (contains a colon). Cheap sanity check that
      # avoids pulling in the ansible.utils collection just for ipaddr.
      - >-
        ess_rtc_external_ip is match('^\d{1,3}(\.\d{1,3}){3}$')
        or ':' in ess_rtc_external_ip
    fail_msg: >-
      ess_rtc_external_ip ({{ ess_rtc_external_ip }}) is not a valid IP
      address. LiveKit advertises this verbatim in ICE candidates; a bad
      value silently breaks Element Call.
    quiet: true

- name: Validate OIDC variables when OIDC is enabled
  ansible.builtin.assert:
    that:
      - ess_oidc_issuer | length > 0
      - ess_oidc_client_secret | length > 0
    fail_msg: OIDC enabled but issuer / client_secret missing.
    quiet: true
  when: ess_oidc_enabled | bool

- name: Prerequisites (docker, networks, dirs, registry login)
  ansible.builtin.import_tasks: prereq.yml

- name: Generate / verify the ess-generated secret bundle
  ansible.builtin.import_tasks: secrets.yml

- name: Render all component configuration files
  ansible.builtin.import_tasks: config.yml

- name: Render compose project file and start the stack
  ansible.builtin.import_tasks: deploy.yml

- name: Post-install (create admin user)
  ansible.builtin.import_tasks: postinstall.yml
  when: ess_create_admin_user | bool