---
- name: Apply overrides
  ansible.builtin.import_playbook: >-
    {{ lookup("ansible.builtin.env", "MOLECULE_SCENARIO_DIRECTORY") }}/overrides.yml

- name: Network setup
  hosts: all
  tasks:
    - name: Disable firewalld
      when: ansible_distribution == "Rocky"
      # Rocky Linux comes with firewalld enabled. It blocks some of the network
      # connections needed for our k3s cluster. For our test setup, we just disable
      # it since the VM host's firewall is still active for connections to and from
      # the Internet.
      # When building your own cluster, please DO NOT blindly copy this. Instead,
      # please create a custom firewall configuration that fits your network design
      # and security needs.
      ansible.builtin.systemd:
        name: firewalld
        enabled: false
        state: stopped
      become: true

    - name: Verify the private cluster interface
      ansible.builtin.assert:
        that:
          - flannel_iface in ansible_facts
          - ansible_facts[flannel_iface].ipv4 is defined
          - ansible_facts[flannel_iface].ipv4.address is defined
        fail_msg: >-
          The Vagrant private interface {{ flannel_iface }} does not have an
          IPv4 address on {{ inventory_hostname }}.

    - name: Verify guest-to-guest cluster network reachability
      ansible.builtin.command:
        argv:
          - ping
          - -c
          - "1"
          - -W
          - "1"
          - >-
            {{ hostvars[groups[group_name_master | default('master')][0]].k3s_node_ip
            | split(',') | first }}
      register: primary_cluster_ping
      until: primary_cluster_ping.rc == 0
      retries: 6
      delay: 2
      changed_when: false

    - name: Verify GitHub release host DNS
      ansible.builtin.getent:
        database: hosts
        key: github.com
      register: github_dns
      retries: 6
      delay: 5
      until: github_dns is succeeded

    - name: Verify k3s checksum URL is reachable
      ansible.builtin.uri:
        url: >-
          https://github.com/k3s-io/k3s/releases/download/{{ k3s_version
          }}/sha256sum-amd64.txt
        method: HEAD
        follow_redirects: safe
        status_code: [200, 302]
        timeout: 15
      register: k3s_checksum_request
      retries: 3
      delay: 5
      until: k3s_checksum_request.status in [200, 302]