---
# Production host provisioning. Idempotent: safe to re-run after a host resize.
# Prepares hosts only (docker, hardening, service account, firewall); the
# application is deployed separately by .gitea/workflows/prod-deploy.yaml.

- name: Common baseline (both hosts)
  hosts: prod
  become: true
  pre_tasks:
    - name: Require a well-formed CI deploy public key
      ansible.builtin.assert:
        that:
          - deploy_ci_pubkey | length > 0
          - deploy_ci_pubkey is search('^(ssh|ecdsa)-')
        fail_msg: >-
          deploy_ci_pubkey is empty or malformed. Generate the key first
          (see deploy/ansible/README.md) or override deploy_ci_pubkey_path.
  roles:
    - common

- name: Main stack host
  hosts: main
  become: true
  roles:
    - main

- name: Telegram bot host
  hosts: tg
  become: true
  roles:
    - tg