---
# Host (hypervisor/workstation) prerequisites for the local dev/test cluster — IaC so the cluster
# can be destroyed & rebuilt with NO remembered manual commands (R-ENV-01, R-PLAT-04).
#
# Runs on the HOST itself (localhost), NOT the cluster nodes. Needs host privilege escalation:
#   ansible-playbook playbooks/host-prereqs.yml --ask-become-pass
# (or configure passwordless sudo / a become password for fully unattended rebuilds).
#
# Idempotent: safe to re-run; only changes what isn't already in the desired state. Uses
# firewall-cmd directly (no extra Ansible collection dependency).
- name: Configure host prerequisites for the local dev cluster
  hosts: hypervisor          # localhost (connection=local set in inventory)
  become: true               # ansible_become_password from vaulted group_vars/hypervisor/vault.yml
  gather_facts: false
  vars:
    # The bootstrap Gitea (bootstrap/gitea/) runs on the host; the in-cluster Flux must reach it
    # over the k3s-dev NAT gateway. firewalld's `libvirt` zone (which owns virbrN) drops
    # VM->host:<port> by default, so this must be opened or Flux cannot fetch the GitOps source.
    gitea_bootstrap_port: 3000
    libvirt_firewalld_zone: libvirt

  tasks:
    - name: Check whether the Gitea port is already allowed on the libvirt zone
      ansible.builtin.command: "firewall-cmd --zone={{ libvirt_firewalld_zone }} --query-port={{ gitea_bootstrap_port }}/tcp"
      register: gitea_port_check
      changed_when: false
      failed_when: false

    - name: Allow the bootstrap-Gitea port from the cluster VMs (permanent + runtime)
      ansible.builtin.command: "{{ item }}"
      loop:
        - "firewall-cmd --zone={{ libvirt_firewalld_zone }} --add-port={{ gitea_bootstrap_port }}/tcp --permanent"
        - "firewall-cmd --zone={{ libvirt_firewalld_zone }} --add-port={{ gitea_bootstrap_port }}/tcp"
      when: "'yes' not in gitea_port_check.stdout"
      changed_when: true

    # Tighter alternative (documented, not default): scope to the cluster subnet with a rich rule
    #   firewall-cmd --zone=libvirt --add-rich-rule='rule family=ipv4 source address=10.73.0.0/24 port port=3000 protocol=tcp accept' [--permanent]