- name: Ensure nftables is available on control-plane nodes
  ansible.builtin.apt:
    name: nftables
    state: present

- name: Validate and deploy the selective relay rules
  ansible.builtin.template:
    src: control-plane-relay.nft.j2
    dest: /etc/k3s-control-plane-relay.nft
    mode: "0644"
    validate: /usr/sbin/nft --check --file %s
  register: control_plane_relay_rules

- name: Configure public DNS names for selective relay
  ansible.builtin.copy:
    content: "{{ tailscale_control_plane_relay_peers | to_nice_json }}\n"
    dest: /etc/k3s-control-plane-relay.json
    mode: "0644"
  register: control_plane_relay_peers

- name: Install the selective relay resolver and systemd units
  ansible.builtin.copy:
    src: "{{ item.src }}"
    dest: "{{ item.dest }}"
    mode: "{{ item.mode }}"
  loop:
    - { src: k3s-control-plane-relay.py, dest: /usr/local/sbin/k3s-control-plane-relay, mode: "0755" }
    - { src: k3s-control-plane-relay.service, dest: /etc/systemd/system/k3s-control-plane-relay.service, mode: "0644" }
    - { src: k3s-control-plane-relay.timer, dest: /etc/systemd/system/k3s-control-plane-relay.timer, mode: "0644" }
  register: control_plane_relay_files

- name: Persist and apply selective relay
  ansible.builtin.systemd:
    name: k3s-control-plane-relay
    enabled: true
    daemon_reload: "{{ control_plane_relay_files.changed }}"
    state: "{{ 'restarted' if control_plane_relay_rules.changed or control_plane_relay_peers.changed or control_plane_relay_files.changed else omit }}"

- name: Enable periodic DNS refresh
  ansible.builtin.systemd:
    name: k3s-control-plane-relay.timer
    enabled: true
    state: started