---
# Prerequisite (create manually before running):
#   kubectl create namespace monitoring
#   kubectl create secret generic grafana-admin-secret \
#     --from-literal=admin-user=admin \
#     --from-literal=admin-password='YOUR_PASSWORD' \
#     -n monitoring
#
# Required CI/CD variables:
#   LOKI_MINIO_PASSWORD   — password for the loki MinIO user (created by this playbook)
#   GRAFANA_ADMIN_PASSWORD — set in grafana-admin-secret above (not read by Ansible)
- name: Deploy PLG logging stack (Loki + Alloy + Grafana)
  hosts: manager_nodes
  become: false
  vars:
    loki_minio_password: "{{ lookup('env', 'LOKI_MINIO_PASSWORD') }}"
  pre_tasks:
    - name: Preflight | Assert LOKI_MINIO_PASSWORD is set
      ansible.builtin.assert:
        that: loki_minio_password | length > 0
        fail_msg: "LOKI_MINIO_PASSWORD env var must be set"
  roles:
    - logging