---
- name: Converge explicitly admitted Railiance Clock host scope
  when: railiance_clock_enabled | bool
  block:
    - name: Require supported host and concrete admission
      ansible.builtin.assert:
        that:
          - ansible_system == 'Linux'
          - ansible_distribution == 'Ubuntu'
          - ansible_distribution_major_version == '24'
          - railiance_clock_admission_ref | length > 0
          - railiance_clock_upstreams | length > 0
          - railiance_clock_host_drift_ppm | int >= 500
          - railiance_clock_max_error_ns | int > railiance_clock_measurement_margin_ns | int
    - name: Gather service facts without changing clocks
      ansible.builtin.service_facts:
    - name: Refuse competing discipline daemons
      ansible.builtin.assert:
        that:
          - ansible_facts.services.get(item, {}).get('state', 'stopped') != 'running'
      loop: [chrony.service, chronyd.service, ntp.service, ntpd.service]
    - name: Ensure the existing time daemon is installed
      ansible.builtin.assert:
        that: "'systemd-timesyncd.service' in ansible_facts.services"
    - name: Configure reviewed timesyncd baseline only when explicitly selected
      when: railiance_clock_manage_timesyncd | bool
      block:
        - name: Create timesyncd configuration directory
          ansible.builtin.file:
            path: /etc/systemd/timesyncd.conf.d
            state: directory
            owner: root
            group: root
            mode: '0755'
        - name: Install sole owner drop-in
          ansible.builtin.template:
            src: timesyncd.conf.j2
            dest: /etc/systemd/timesyncd.conf.d/60-railiance-clock.conf
            owner: root
            group: root
            mode: '0644'
          notify: Restart reviewed timesyncd
        - name: Keep admitted daemon enabled
          ansible.builtin.systemd:
            name: systemd-timesyncd
            enabled: true
            state: started
    - name: Install authority and health export
      when: railiance_clock_authority_enabled | bool
      ansible.builtin.include_tasks: authority.yaml