---
# Node baseline — first-boot floor for k3s/Cilium/Longhorn, moved from cloud-init into
# Ansible so Proxmox provisioning stays API-only (no SSH/SFTP to the hypervisor). Runs
# FIRST in site.yml, before k3s. Idempotent; safe to re-run.
#
# TARGET (R-ENV-02): `k3s_hosts` defaults to dev's `k3s_servers`; prod is
#   ansible-playbook playbooks/node-baseline.yml -e k3s_hosts=k3s_prod
# See README.md "Targeting prod". The pattern is the one node-health.yml established.
#
# TAGS — this role is the only way `smartmontools` (and the rest of the package floor)
# reaches a node, but its data-disk tasks need block devices that prod has NOT decided
# yet (infra/PROD-PROVISIONING.md §2). Run JUST the package floor with:
#   ansible-playbook playbooks/node-baseline.yml -e k3s_hosts=k3s_prod --tags packages
# `--tags packages` runs the apt task ONLY; every disk task carries the `disks` tag and
# is therefore skipped, so the BLOCKED placeholder devices can never be touched. A full
# (untagged) run against a node whose device vars are still placeholders fails fast on an
# explicit assert instead of handing a bogus path to mkfs. See roles/node_baseline.
- name: Baseline the k3s nodes (packages, kernel modules, Longhorn disk, swap-off)
  hosts: "{{ k3s_hosts | default('k3s_servers') }}"
  become: true
  gather_facts: true
  roles:
    - node_baseline