---
# Main stack host: public web + bot-link ports and the external 'edge' network
# the compose stack attaches caddy to.

- name: Open public web and bot-link ports
  community.general.ufw:
    rule: allow
    port: "{{ item }}"
    proto: tcp
  loop:
    - "80"    # HTTP (ACME challenge + redirect to HTTPS)
    - "443"   # HTTPS (caddy edge)
    - "9443"  # bot-link mTLS (remote bot dials in; mutual TLS gates access)

- name: Ensure the external 'edge' docker network exists
  community.docker.docker_network:
    name: edge
    state: present