---
# 首次创建专用密码；已存在的数据与丢失秘密不能组合为自动重置。
- name: 检查已有实例数据
  hosts: pg_hosts
  become: true
  gather_facts: false
  tasks:
    - name: 检查各实例 PG_VERSION
      ansible.builtin.stat:
        path: "{{ pg_data_root }}/{{ item }}/data/PG_VERSION"
      loop: "{{ pg_instances }}"
      register: pg_secret_data_files
    - name: 记录现有数据边界
      ansible.builtin.set_fact:
        pg_has_data: "{{ pg_secret_data_files.results | selectattr('stat.exists') | list | length > 0 }}"
- name: 首次将随机实例凭据写入 Bao
  hosts: localhost
  connection: local
  gather_facts: false
  tasks:
    - name: 要求显式初始化与管理身份
      ansible.builtin.assert:
        that:
          - pg_allow_initialize | bool
          - pg_bao_token | length > 0
      no_log: true
    - name: 逐实例确认元数据和 CAS 创建
      ansible.builtin.include_tasks: tasks/initialize-secret.yml
      loop: [prod, dev]
      loop_control:
        loop_var: pg_secret_instance