---
- name: Reconcile sandbox LXC nodes
  hosts: sandbox_pve
  gather_facts: false
  serial: 1
  roles:
    - sandbox_lxc

- name: Reconcile sandbox node OS baseline
  hosts: k3s_cluster
  gather_facts: false
  roles:
    - sandbox_base

- name: Reconcile sandbox PostgreSQL primary
  hosts: postgres_primary
  gather_facts: false
  roles:
    - sandbox_postgresql

- name: Reconcile sandbox PostgreSQL synchronous standby
  hosts: postgres_standby
  gather_facts: false
  roles:
    - sandbox_postgresql

- name: Finalize synchronous PostgreSQL settings
  hosts: postgres_primary
  gather_facts: false
  roles:
    - sandbox_postgresql

- name: Validate runtime K3s datastore credential
  hosts: k3s_cluster
  gather_facts: false
  tasks:
    - name: Require the Bao-provided PostgreSQL password
      ansible.builtin.assert:
        that:
          - sandbox_postgresql_k3s_password | length > 0
          - server_config_yaml is defined
          - (server_config_yaml | from_yaml)['datastore-endpoint'] == sandbox_k3s_datastore_endpoint
        fail_msg: SANDBOX_K3S_DB_PASSWORD must be populated from Bao
        quiet: true
      no_log: true

- name: Install the sandbox K3s control plane
  ansible.builtin.import_playbook: k3s.orchestration.site

- name: Reconcile Flux controllers and root sync
  hosts: sandbox1
  gather_facts: false
  roles:
    - sandbox_flux

- name: Reconcile central SPIRE access to sandbox Kubernetes
  hosts: sandbox1
  gather_facts: false
  roles:
    - sandbox_spire_bootstrap