00_core.yml

---
- include_tasks: utils/once/flag.yml

- name: "🐝 Swarm-only node setup (cluster bootstrap + shared CA anchor)"
  when: IS_SWARM_MODE
  block:
    - name: "🥾 Join the swarm behind the ingress guard"
      ansible.builtin.include_tasks: 00_core/join.yml

    - name: "✅ Ensure shared Root CA on every swarm node (manager mints, workers fetch)"
      ansible.builtin.include_role:
        name: sys-ca-selfsigned
      when:
        - (TLS_MODE | lower) == 'self_signed'
        - run_once_sys_ca_selfsigned is not defined