---
# Deploy Supabase on OpenShift (SNO) via the supabase-community Helm chart.
#
# Chart: https://github.com/supabase-community/supabase-kubernetes
#
# Prerequisites:
#   - cert-manager installed (deploy_openshift.yml --tags sno_deploy_certmanager)
#   - NFS StorageClass available (deploy_openshift.yml --tags sno_deploy_nfs)
#   - supabase-deployer ServiceAccount provisioned and token saved to 1Password:
#       ansible-navigator run playbooks/deploy_openshift.yml --tags sno_deploy_service_accounts
#   - vault_supabase_deployer_token set in host_vars (see hashivault_secrets.yml)
#
# All Supabase secrets (JWT, DB password, etc.) are auto-generated on first run
# and stored in Vault at supabase_vault_path. No manual secret setup required.
#
# Usage:
#   ansible-navigator run playbooks/deploy_supabase.yml --mode stdout
#   ansible-navigator run playbooks/deploy_supabase.yml --mode stdout -e supabase_chart_version=0.0.9
#   ansible-navigator run playbooks/deploy_supabase.yml --mode stdout -e supabase_db_storage_size=20Gi

- name: Deploy Supabase on OpenShift
  hosts: sno.openshift.toal.ca
  gather_facts: false
  connection: local

  environment:
    K8S_AUTH_HOST: "{{ supabase_k8s_api_url }}"
    K8S_AUTH_API_KEY: "{{ vault_supabase_deployer_token }}"
    K8S_AUTH_VERIFY_SSL: "false"

  pre_tasks:
    - name: Verify supabase-deployer token is available
      ansible.builtin.assert:
        that:
          - vault_supabase_deployer_token is defined
          - vault_supabase_deployer_token | length > 0
        fail_msg: >-
          vault_supabase_deployer_token is not set.
          Provision the ServiceAccount with:
            ansible-navigator run playbooks/deploy_openshift.yml --tags sno_deploy_service_accounts
          Then save the displayed token to 1Password and reference it as vault_supabase_deployer_token.

  roles:
    - role: supabase