---
# Shared connection + cluster facts for every k3s node.

# cloud-init created this login user (tofu var login_user); it has NOPASSWD sudo.
ansible_user: k3s

# --- environment group NAMES (R-ENV-02: one set of roles, scoped overrides) ---------
# The GROUP NAMES a role uses to answer "who is MY environment's primary / MY
# environment's servers?". Roles must never hardcode `groups['k3s_primary']`, or they
# only ever work against dev. These two are the dev values; group_vars/k3s_prod/vars.yml
# overrides them with k3s_prod_primary / k3s_prod, so a host in the prod group resolves
# its own primary automatically — exactly the way k3s_api_host below is overridden there.
#
# These are GROUP NAMES (keys into `groups`), NOT host patterns. The play-level target
# pattern is a separate, extra-vars-only knob (`k3s_hosts` / `k3s_primary_hosts` /
# `k3s_secondary_hosts`, see playbooks/*.yml) because Ansible templates a play's `hosts:`
# before it has any host context and so cannot see group_vars at all.
k3s_primary_group: k3s_primary
k3s_servers_group: k3s_servers

# Filename of the kubeconfig the controller-side roles (cilium, cluster_verify,
# flux_bootstrap) fetch from the primary into infra/ansible/.cache/. Scoped per
# environment so pointing those plays at prod can NEVER overwrite the dev kubeconfig
# that infra/devcontainer/dev.sh exports as $KUBECONFIG — an operator's `kubectl get
# nodes` silently answering from prod would be a genuinely dangerous mix-up.
# group_vars/k3s_prod/vars.yml overrides this to prod.kubeconfig. (.cache/ is gitignored;
# a kubeconfig is a credential.)
cluster_kubeconfig_name: dev.kubeconfig

# The kube-apiserver endpoint the whole stack agrees on: the primary's REAL node IP.
# NOTE: ansible_host is now the pfSense NAT SSH target (192.168.2.102:225x), NOT the node
# IP — so we read the real 192.168.1.x from k3s_node_ip instead. Used for k3s --tls-san /
# secondary --server AND for Cilium k8sServiceHost so the Ansible bootstrap and the Flux
# HelmRelease stay in PARITY (docs/02 contract).
k3s_api_host: "{{ hostvars[groups[k3s_primary_group][0]]['k3s_node_ip'] }}"
k3s_api_port: 6443

# Control-plane HA VIP floated by kube-vip (roles/kube_vip). A stable failover
# endpoint for the kube-apiserver, fronted by an operator pfSense port-forward at
# 192.168.1.49:6443. Shared here so BOTH kube_vip AND the k3s_server tls-san list
# agree on the address (the serving cert must carry this IP or TLS via the VIP
# fails to validate).
kube_vip_address: "192.168.1.49"

# Controller (dev container) reaches the kube-API DIRECTLY via the pfSense NAT
# (192.168.2.50:6443 -> kube-vip VIP 192.168.1.49:6443) — no SSH tunnel. TLS is
# validated against the VIP via tls-server-name (the VIP IP is in the serving cert's
# tls-san list, so TLS through the NAT validates). Only the controller kubeconfig uses
# these; k8sServiceHost (in-cluster) stays the real node IP.
cluster_controller_api_server: "https://192.168.2.50:6443"
cluster_controller_tls_server_name: "{{ kube_vip_address }}"