---
# flux_bootstrap role defaults — the hand-off to the OTHER worker's bootstrap/.
#
# THIS ROLE AUTHORS THE CALL, IT DOES NOT OWN bootstrap/. The Security Engineer
# (T-1.4 SOPS/age) and GitOps Engineer (T-1.4 Flux) author bootstrap/sops/ and
# bootstrap/flux/. This role INVOKES their entrypoints. The exact script names /
# args below are ASSUMPTIONS the PM must reconcile with those deliverables — see
# roles/flux_bootstrap/tasks/main.yml and infra/ansible/README.md "Interface".

# Filename from cluster_kubeconfig_name (group_vars): dev.kubeconfig / prod.kubeconfig.
flux_bootstrap_kubeconfig: "{{ playbook_dir }}/../.cache/{{ cluster_kubeconfig_name | default('dev.kubeconfig') }}"

# Repo root, relative to playbooks/ (infra/ansible/playbooks -> ../../..).
flux_bootstrap_repo_root: "{{ playbook_dir }}/../../.."

# Assumed interface of bootstrap/sops (Security Engineer, T-1.4):
#   installs the age private key as the `sops-age` Secret in flux-system so Flux
#   can decrypt. Private key stays OUT of git (.gitignore guards age.key/*.key).
flux_bootstrap_sops_cmd: "bash {{ flux_bootstrap_repo_root }}/bootstrap/sops/install-age-key.sh"

# Assumed interface of bootstrap/flux (GitOps Engineer, T-1.4):
#   runs `flux install` + `kubectl apply -k <env path>` against this cluster.
flux_bootstrap_flux_cmd: "bash {{ flux_bootstrap_repo_root }}/bootstrap/flux/bootstrap.sh"

# --- WHICH ENVIRONMENT OVERLAY THIS BOOTSTRAPS (R-ENV-02) -------------------------
# The one thing that makes this role environment-agnostic. bootstrap/flux/bootstrap.sh
# reads FLUX_ENV_PATH (default clusters/dev) and ends with `kubectl apply -k <that>`;
# tasks/main.yml exports this value into that variable, so the role NEVER names an
# environment and the task graph is identical for dev and prod.
#
# THE DEFAULT IS DEV ON PURPOSE — dev is LIVE, and group_vars/all.yml carries no
# override, so a dev run resolves exactly the value it always had (clusters/dev) and
# behaves byte-for-byte as before.
#
# PROD OVERRIDES IT in inventory/group_vars/k3s_prod/vars.yml — the same group_vars
# seam as kube_vip_address / k3s_data_dir / cluster_kubeconfig_name /
# node_baseline_backports_kernel. No role fork, no per-run extra-var, no second
# playbook: group membership decides. Before this existed the role could bootstrap
# ONLY clusters/dev, so prod bring-up was impossible without editing the role.
flux_bootstrap_env_path: "clusters/dev"