---
# This integration is intentionally read-only.
# No Dynu mutations are permitted in this repo at this stage.
- name: Build Dynu DNS read-only inventory artifacts
  hosts: localhost
  connection: local
  gather_facts: false
  vars:
    repo_root: "{{ playbook_dir }}/../../.."

  tasks:
    - name: Assert read-only guard variable is set
      ansible.builtin.assert:
        that:
          - lookup('ansible.builtin.env', 'DYNU_READ_ONLY') == 'true'
        fail_msg: "Refusing to run: DYNU_READ_ONLY must be exactly 'true'."

    - name: Fetch Dynu DNS (GET-only script)
      ansible.builtin.command: python3 scripts/dynu/fetch_dynu_dns.py
      args:
        chdir: "{{ repo_root }}"

    - name: Correlate Dynu with Traefik and generate docs
      ansible.builtin.command: python3 scripts/dynu/correlate_dynu_with_traefik.py
      args:
        chdir: "{{ repo_root }}"