#!/usr/bin/env bash
# Run a playbook while holding the deploy lock, so only one agent deploys at a
# time. Arguments go straight to ansible-playbook.
#   bin/deploy --tags gitea            (site.yml)
#   bin/deploy --check --diff
#   PLAYBOOK=dns.yml bin/deploy
# Real runs only work from a clean checkout of origin/main (deploy-guard.yml).
set -euo pipefail
. "$(dirname "$0")/_common.sh"
link_vault
take_lock deploy
cd "$repo"
"$main_checkout/.venv/bin/ansible-playbook" "${PLAYBOOK:-site.yml}" -i hosts.yml \
    --vault-password-file "$main_checkout/vault_pass" "$@"