---
# flux_bootstrap role defaults — the hand-off to the OTHER worker's bootstrap/.
#
# THIS ROLE AUTHORS THE CALL, IT DOES NOT OWN bootstrap/. The Security Engineer
# (T-1.4 SOPS/age) and GitOps Engineer (T-1.4 Flux) author bootstrap/sops/ and
# bootstrap/flux/. This role INVOKES their entrypoints. The exact script names /
# args below are ASSUMPTIONS the PM must reconcile with those deliverables — see
# roles/flux_bootstrap/tasks/main.yml and infra/ansible/README.md "Interface".

flux_bootstrap_kubeconfig: "{{ playbook_dir }}/../.cache/dev.kubeconfig"

# Repo root, relative to playbooks/ (infra/ansible/playbooks -> ../../..).
flux_bootstrap_repo_root: "{{ playbook_dir }}/../../.."

# Assumed interface of bootstrap/sops (Security Engineer, T-1.4):
#   installs the age private key as the `sops-age` Secret in flux-system so Flux
#   can decrypt. Private key stays OUT of git (.gitignore guards age.key/*.key).
flux_bootstrap_sops_cmd: "bash {{ flux_bootstrap_repo_root }}/bootstrap/sops/install-age-key.sh"

# Assumed interface of bootstrap/flux (GitOps Engineer, T-1.4):
#   runs `flux bootstrap ... --path=clusters/dev` against this cluster.
flux_bootstrap_flux_cmd: "bash {{ flux_bootstrap_repo_root }}/bootstrap/flux/bootstrap.sh"