---
# Mutating deployment surface for RAIL-HO-WP-0012-T04. This playbook is not
# included by bootstrap or verification and requires an exact operator token.
- hosts: all
  become: true
  vars_files:
    - ../inventory/group_vars/all.yaml
  pre_tasks:
    - name: Require exact approval for S1 backup timer deployment
      ansible.builtin.assert:
        that:
          - railiance_backup_deploy_approval | default('') == 'DEPLOY-RAIL-HO-WP-0012-S1-BACKUP-TIMER'
          - railiance_backup_source_revision | default('') is match('^[0-9a-f]{40}$')
        fail_msg: >-
          Refusing host mutation. Set
          railiance_backup_deploy_approval=DEPLOY-RAIL-HO-WP-0012-S1-BACKUP-TIMER
          and a 40-character railiance_backup_source_revision after reviewing
          this play and its rendered units.
  roles:
    - role: s1_backup