---
- name: Common OS prerequisites for all k8s nodes
  hosts: k8s
  become: true

  vars:
    timezone: Asia/Ho_Chi_Minh   # GMT+7

  tasks:
    # ── Timezone + NTP ────────────────────────────────────────────────
    - name: Set timezone
      community.general.timezone:
        name: "{{ timezone }}"

    - name: Ensure chrony is installed
      dnf:
        name: chrony
        state: present

    - name: Enable and start chronyd
      systemd:
        name: chronyd
        enabled: true
        state: started

    # ── SELinux ───────────────────────────────────────────────────────
    - name: Set SELinux to permissive (runtime)
      command: setenforce 0
      ignore_errors: true   # already permissive/disabled is fine

    - name: Set SELinux to permissive (persistent)
      replace:
        path: /etc/selinux/config
        regexp: '^SELINUX=enforcing'
        replace: 'SELINUX=permissive'

    # ── Firewalld ─────────────────────────────────────────────────────
    - name: Check if firewalld is installed
      command: systemctl list-unit-files firewalld.service
      register: firewalld_check
      changed_when: false
      failed_when: false

    - name: Disable and stop firewalld
      systemd:
        name: firewalld
        enabled: false
        state: stopped
      when: "'firewalld.service' in firewalld_check.stdout"

    # ── Swap ──────────────────────────────────────────────────────────
    - name: Disable swap now
      command: swapoff -a
      when: ansible_facts['swaptotal_mb'] > 0

    - name: Remove swap from /etc/fstab
      replace:
        path: /etc/fstab
        regexp: '^([^#].*\s+swap\s+.*)$'
        replace: '# \1'

    # ── Kernel modules ────────────────────────────────────────────────
    - name: Load kernel modules at boot
      copy:
        dest: /etc/modules-load.d/k8s.conf
        content: |
          overlay
          br_netfilter

    - name: Load kernel modules now
      modprobe:
        name: "{{ item }}"
      loop:
        - overlay
        - br_netfilter

    # ── sysctl ────────────────────────────────────────────────────────
    - name: Set sysctl for k8s networking
      copy:
        dest: /etc/sysctl.d/k8s.conf
        content: |
          net.bridge.bridge-nf-call-iptables  = 1
          net.bridge.bridge-nf-call-ip6tables = 1
          net.ipv4.ip_forward                 = 1

    - name: Apply sysctl
      command: sysctl --system

    # ── NFS client ────────────────────────────────────────────────────
    - name: Install nfs-utils (required for NFS PVC mounts)
      dnf:
        name: nfs-utils
        state: present