---
- name: Validate Traefik variables
  ansible.builtin.import_tasks: validate.yaml

- name: Create Traefik Docker network
  community.docker.docker_network:
    name: "{{ traefik_network }}"
    driver: bridge
    state: present

- name: Deploy Traefik
  ansible.builtin.include_role:
    name: docker_service
  vars:
    service_name: "traefik"
    service_base_path: "{{ traefik_base_path }}"
    service_directories:
      - { path: "config" }
      - { path: "letsencrypt" }
      - { path: "logs" }
    service_templates:
      - { src: "traefik.yml.j2", dest: "traefik.yml" }
      - { src: "dynamic.yml.j2", dest: "config/dynamic.yml" }
      - { src: "env.j2", dest: ".env" }
      - { src: "docker-compose.yml.j2", dest: "docker-compose.yml" }
    # The Coraza WAF middlewares were never wired to a router
    service_absent:
      - config/waf-middleware.yml
      - config/waf-wp.yml
    health_check_host: "{{ wireguard_ip }}"  # dashboard listens on WireGuard only
    health_check_port: "{{ traefik_dashboard_port }}"
    health_check_delay: 3