---
- name: Install base packages
  ansible.builtin.dnf:
    name:
      - curl
      - vim-enhanced
      - chrony
      - firewalld
      - sudo
      - tar
      - policycoreutils-python-utils
    state: present
  tags: [common]

- name: Set timezone
  community.general.timezone:
    name: "{{ timezone }}"
  tags: [common]

- name: Deploy chrony configuration
  ansible.builtin.template:
    src: chrony.conf.j2
    dest: /etc/chrony.conf
    owner: root
    group: root
    mode: "0644"
  notify: restart chronyd
  tags: [common]

- name: Enable and start chronyd
  ansible.builtin.systemd:
    name: chronyd
    enabled: true
    state: started
  tags: [common]

- name: Set hostname from inventory
  ansible.builtin.hostname:
    name: "{{ inventory_hostname }}"
  tags: [common]

- name: Enable and start firewalld
  ansible.builtin.systemd:
    name: firewalld
    enabled: true
    state: started
  tags: [common]

- name: Set default firewalld zone
  ansible.builtin.command: "firewall-cmd --set-default-zone={{ firewall_default_zone }}"
  changed_when: true
  tags: [common]

- name: Allow SSH from the administration subnet
  ansible.posix.firewalld:
    zone: "{{ firewall_default_zone }}"
    rich_rule: >-
      rule family="ipv4" source address="{{ firewall_admin_subnet }}"
      port protocol="tcp" port="22" accept
    permanent: true
    immediate: true
    state: enabled
  tags: [common]

- name: Check available memory meets the minimum requirement
  ansible.builtin.assert:
    that:
      - ansible_facts['memtotal_mb'] >= common_min_memory_mb
    fail_msg: >-
      {{ inventory_hostname }} has {{ ansible_facts['memtotal_mb'] }} MB RAM,
      below the configured minimum of {{ common_min_memory_mb }} MB
      (common_min_memory_mb). Both AWX/k3s and GitLab are memory-hungry;
      review sizing before continuing.
    success_msg: "Memory check passed ({{ ansible_facts['memtotal_mb'] }} MB available)."
  tags: [common]