---
- name: Set same timezone on every Server
  community.general.timezone:
    name: "{{ system_timezone }}"
  when: (system_timezone is defined) and (system_timezone != "Your/Timezone")

# k3s recommends swap be disabled on all nodes. Disabling swap is all-or-nothing
# across the cluster: leaving it enabled on some nodes but not others creates
# uneven scheduling/latency behavior. This block turns swap off and comments out
# the swap entries in /etc/fstab so it stays off across reboots. It is idempotent
# and a no-op when swap is already disabled or swapoff is unavailable.
- name: Disable swap on all cluster nodes
  when: disable_swap
  block:
    - name: Turn off swap now
      ansible.builtin.command: swapoff -a
      register: swapoff_result
      changed_when: false
      failed_when: false

    - name: Comment out swap entries in fstab
      ansible.builtin.replace:
        path: /etc/fstab
        regexp: '^([^#][^\n]*\s+swap\s+)'
        replace: '# \\1'
      register: fstab_swap


- name: Set SELinux to disabled state
  ansible.posix.selinux:
    state: disabled
  when: ansible_os_family == "RedHat"

- name: Enable IPv4 forwarding
  ansible.posix.sysctl:
    name: net.ipv4.ip_forward
    value: "1"
    state: present
    reload: true
  tags: sysctl

- name: Enable IPv6 forwarding
  ansible.posix.sysctl:
    name: net.ipv6.conf.all.forwarding
    value: "1"
    state: present
    reload: true
  tags: sysctl

- name: Enable IPv6 router advertisements
  ansible.posix.sysctl:
    name: net.ipv6.conf.all.accept_ra
    value: "2"
    state: present
    reload: true
  tags: sysctl

- name: Check if br_netfilter module exists
  ansible.builtin.shell: |
    set -o pipefail
    find /lib/modules/$(uname -r) -name "br_netfilter.ko*" | wc -l
  args:
    executable: /bin/bash
  register: br_netfilter_exists
  changed_when: false
  when: ansible_os_family == "RedHat"
  tags: sysctl

- name: Install kernel-modules-extra if br_netfilter missing
  ansible.builtin.yum:
    name: kernel-modules-extra
    state: present
    update_cache: true
  register: kernel_modules_installed
  when:
    - ansible_os_family == "RedHat"
    - br_netfilter_exists.stdout | int == 0

- name: Add br_netfilter to /etc/modules-load.d/
  ansible.builtin.copy:
    content: br_netfilter
    dest: /etc/modules-load.d/br_netfilter.conf
    mode: u=rw,g=,o=
  when: ansible_os_family == "RedHat"

- name: Load br_netfilter
  community.general.modprobe:
    name: br_netfilter
    state: present
  when: ansible_os_family == "RedHat"

- name: Set bridge-nf-call-iptables (just to be sure)
  ansible.posix.sysctl:
    name: "{{ item }}"
    value: "1"
    state: present
    reload: true
  when: ansible_os_family == "RedHat"
  loop:
    - net.bridge.bridge-nf-call-iptables
    - net.bridge.bridge-nf-call-ip6tables
  tags: sysctl

- name: Add /usr/local/bin to sudo secure_path
  ansible.builtin.lineinfile:
    line: Defaults    secure_path = {{ secure_path[ansible_os_family] }}
    regexp: Defaults(\s)*secure_path(\s)*=
    state: present
    insertafter: EOF
    path: /etc/sudoers
    validate: visudo -cf %s
  when: ansible_os_family in [ "RedHat", "Suse" ]