---
- name: Validate Proxmox API inputs
  ansible.builtin.assert:
    that:
      - pve_api_host | length > 0
      - pve_api_user | length > 0
      - pve_api_token_id | length > 0
      - pve_api_token_secret | length > 0
    fail_msg: Missing Proxmox API environment variables
  run_once: true
  delegate_to: localhost
  no_log: true

- name: Read current PVE SDN zones
  ansible.builtin.uri:
    url: "https://{{ pve_api_host }}:8006/api2/json/cluster/sdn/zones"
    headers:
      Authorization: >-
        PVEAPIToken={{ pve_api_user }}!{{ pve_api_token_id }}={{ pve_api_token_secret }}
    ca_path: /etc/ssl/certs/ca-certificates.crt
    return_content: true
  register: pve_sdn_zone_state
  run_once: true
  delegate_to: localhost
  no_log: true

- name: Reconcile the PVE VLAN zone
  community.proxmox.proxmox_zone:
    api_host: "{{ pve_api_host }}"
    api_user: "{{ pve_api_user }}"
    api_token_id: "{{ pve_api_token_id }}"
    api_token_secret: "{{ pve_api_token_secret }}"
    validate_certs: "{{ pve_api_validate_certs }}"
    ca_path: /etc/ssl/certs/ca-certificates.crt
    zone: "{{ pve_sdn_zone }}"
    type: vlan
    bridge: "{{ pve_sdn_bridge }}"
    mtu: "{{ pve_sdn_mtu }}"
    nodes: "{{ groups['pve'] | join(',') }}"
    update: true
    state: present
  when: >-
    _current_zone | length == 0 or
    _current_zone.type != 'vlan' or
    _current_zone.bridge != pve_sdn_bridge or
    _current_zone.mtu | int != pve_sdn_mtu | int or
    _current_zone.nodes != (groups['pve'] | join(','))
  run_once: true
  delegate_to: localhost
  no_log: true
  vars:
    ansible_python_interpreter: "{{ pve_api_python_interpreter }}"
    _current_zone: >-
      {{ pve_sdn_zone_state.json.data |
         selectattr('zone', 'equalto', pve_sdn_zone) | first | default({}) }}

# The module owns the SDN global lock and applies pending configuration before
# releasing it; a separate unconditional `pvesh set /cluster/sdn` is harmful
# because it reports changed on every run.
- name: Reconcile PVE VNets
  community.proxmox.proxmox_vnet:
    api_host: "{{ pve_api_host }}"
    api_user: "{{ pve_api_user }}"
    api_token_id: "{{ pve_api_token_id }}"
    api_token_secret: "{{ pve_api_token_secret }}"
    validate_certs: "{{ pve_api_validate_certs }}"
    ca_path: /etc/ssl/certs/ca-certificates.crt
    vnet: "{{ item.name }}"
    zone: "{{ pve_sdn_zone }}"
    tag: "{{ item.tag }}"
    alias: "{{ item.alias }}"
    update: true
    state: present
  loop: "{{ pve_sdn_vnets }}"
  loop_control:
    label: "{{ item.name }} (VLAN {{ item.tag }})"
  run_once: true
  delegate_to: localhost
  no_log: true
  vars:
    ansible_python_interpreter: "{{ pve_api_python_interpreter }}"