---
- name: Validate sandbox PostgreSQL inputs
  ansible.builtin.assert:
    that:
      - sandbox_postgresql_k3s_password | length >= 32
      - sandbox_postgresql_replication_password | length >= 32
      - inventory_hostname in groups['postgres_primary'] or inventory_hostname in groups['postgres_standby']
    fail_msg: Missing Bao-provided PostgreSQL credentials or invalid inventory role
  no_log: true

- name: Install PostgreSQL packages
  ansible.builtin.apt:
    name:
      - postgresql-{{ sandbox_postgresql_version }}
      - postgresql-client-{{ sandbox_postgresql_version }}
      - python3-psycopg2
    state: present
    update_cache: true
    cache_valid_time: 3600

- name: Check whether synchronous replication has completed bootstrap
  ansible.builtin.stat:
    path: /etc/postgresql/{{ sandbox_postgresql_version }}/main/sandbox-synchronous-ready
  register: sandbox_postgresql_synchronous_marker

- name: Install sandbox PostgreSQL access policy
  ansible.builtin.template:
    src: pg_hba.conf.j2
    dest: /etc/postgresql/{{ sandbox_postgresql_version }}/main/pg_hba.conf
    owner: postgres
    group: postgres
    mode: "0640"
  notify: Restart sandbox PostgreSQL

- name: Install sandbox PostgreSQL server settings
  ansible.builtin.template:
    src: sandbox.conf.j2
    dest: /etc/postgresql/{{ sandbox_postgresql_version }}/main/conf.d/99-sandbox.conf
    owner: postgres
    group: postgres
    mode: "0644"
  notify: Restart sandbox PostgreSQL

- name: Configure sandbox PostgreSQL primary
  ansible.builtin.include_tasks: primary.yml
  when: inventory_hostname in groups['postgres_primary']

- name: Configure sandbox PostgreSQL standby
  ansible.builtin.include_tasks: standby.yml
  when: inventory_hostname in groups['postgres_standby']