# Class: profiles::puppet::client
#
# This class manages Puppet client configuration.
#
# site/profile/manifests/puppet/client.pp
class profiles::puppet::client (
  Array  $dns_alt_names                  = [$trusted['certname']],
  String $server                         = 'puppetmaster',
  String $ca_server                      = 'puppetca',
  Optional[String] $report_server        = undef,
  String $environment                    = 'develop',
  Integer $runinterval                   = 1800,
  Integer $runtimeout                    = 3600,
  Boolean $show_diff                     = true,
  Boolean $usecacheonfailure             = false,
  Integer $facts_soft_limit              = 4096,
  Boolean $splay                         = true,
  Integer $splaylimit                    = 600,
  Optional[Stdlib::Absolutepath] $ssldir = undef,
) {

  # Pull in the k8s-migration switch. When
  # profiles::puppet::migrate::enabled is true at ANY hiera layer
  # (node/role/common) the effective endpoints below flip to the k8s
  # servers and a fresh ssldir -- no other hiera keys required. This class
  # never includes client.pp, so there is no include cycle.
  include profiles::puppet::migrate

  # Effective values fed to the template. Precedence differs by param type:
  #
  #   ssldir / report_server (Optional, default undef): an explicit client
  #     param wins; else the migrate-derived value when enabled; else the
  #     legacy default (undef -> template omits ssldir; report_server -> server).
  #
  #   server / ca_server (String, no undef sentinel): the migrate value wins
  #     when migrate::enabled, otherwise the client param (which is the legacy
  #     default unless an operator set it explicitly in hiera). To pin a
  #     bespoke server while enabled, leave enabled => false for that target
  #     and set profiles::puppet::client::server directly.
  $migrate_on = $profiles::puppet::migrate::enabled

  $effective_server = $migrate_on ? {
    true    => $profiles::puppet::migrate::new_server,
    default => $server,
  }
  $effective_ca_server = $migrate_on ? {
    true    => $profiles::puppet::migrate::new_ca_server,
    default => $ca_server,
  }
  # report_server: explicit param wins; else follow the effective server.
  $effective_report_server = $report_server ? {
    undef   => $effective_server,
    default => $report_server,
  }
  # ssldir: explicit param wins; else the fresh k8s ssldir when migrating;
  # else undef (template omits the key, i.e. puppet's built-in default).
  $effective_ssldir = $ssldir ? {
    undef   => $migrate_on ? {
      true    => $profiles::puppet::migrate::new_ssldir,
      default => undef,
    },
    default => $ssldir,
  }

  # dont manage puppet.conf if this is a puppetmaster
  if $facts['enc_role'] != 'roles::infra::puppet::master' {


    $dns_alt_names_string = join(sort($dns_alt_names), ',')

    # Assuming you want to manage puppet.conf with this profile
    file { '/etc/puppetlabs/puppet/puppet.conf':
      ensure  => 'present',
      content => template('profiles/puppet/client/puppet.conf.erb'),
      owner   => 'root',
      group   => 'root',
      mode    => '0644',
      notify  => Service['puppet'],
    }

    package { 'toml_puppetagent_gem':
      ensure   => installed,
      name     => 'toml',
      provider => 'puppet_gem',
      notify   => Service['puppet'],
    }
  }
}