---
# Part of role: vlan50-parent
# Called by: ansible/playbooks/vlan50-parent.yaml
# Description: Creates nik-debian's persistent tagged VLAN 50 subinterface
#   ({{ vlan50_subinterface }}) without touching its existing untagged
#   VLAN 40 config (node IP, default route, k3s identity, host DNS). See
#   this role's defaults/main.yaml for the switch-readiness precondition.

- name: Install the vlan package (ifupdown VLAN support)
  ansible.builtin.apt:
    name: vlan
    state: present
    update_cache: true

- name: Load the 8021q kernel module now
  community.general.modprobe:
    name: 8021q
    state: present

- name: Persist the 8021q kernel module across reboots
  ansible.builtin.copy:
    dest: /etc/modules-load.d/8021q.conf
    content: |
      # Managed by Ansible (role: vlan50-parent).
      8021q
    mode: "0644"
    owner: root
    group: root

- name: Write the VLAN 50 subinterface definition
  ansible.builtin.template:
    src: vlan50.interface.j2
    dest: "/etc/network/interfaces.d/{{ vlan50_subinterface }}"
    mode: "0644"
    owner: root
    group: root
  register: vlan50_iface_file

- name: Check whether the subinterface is already up
  ansible.builtin.command: "ip link show {{ vlan50_subinterface }}"
  register: vlan50_iface_check
  changed_when: false
  failed_when: false

- name: Bring up the VLAN 50 subinterface
  ansible.builtin.command: "ifup {{ vlan50_subinterface }}"
  when: vlan50_iface_check.rc != 0 or vlan50_iface_file is changed

- name: Confirm the subinterface is up with no L3 address
  ansible.builtin.command: "ip -brief addr show {{ vlan50_subinterface }}"
  register: vlan50_iface_state
  changed_when: false

- name: Assert VLAN 50 parent is UP and carries no IPv4/IPv6 address
  ansible.builtin.assert:
    that:
      - "'UP' in vlan50_iface_state.stdout or 'UNKNOWN' in vlan50_iface_state.stdout"
      - vlan50_iface_state.stdout.split() | select('match', '^[0-9]+\\.[0-9]+\\.[0-9]+\\.[0-9]+/') | list | length == 0
    fail_msg: "{{ vlan50_subinterface }} is either down or unexpectedly carries an IPv4 address: {{ vlan50_iface_state.stdout }}"

- name: Read current default route
  ansible.builtin.command: ip -4 route show default
  register: vlan50_current_default_route
  changed_when: false

- name: Assert the host default route is still the untagged VLAN 40 interface
  ansible.builtin.assert:
    that:
      - vlan50_current_default_route.stdout is search('dev ' + vlan50_parent_interface + '(\s|$)')
      - not (vlan50_current_default_route.stdout is search('dev ' + vlan50_subinterface + '(\s|$)'))
    fail_msg: >-
      nik-debian's default route is not via {{ vlan50_parent_interface }}
      ({{ vlan50_current_default_route.stdout }}) — VLAN 50 must never
      become the host default route.