# Usage:
#   ansible-playbook -i hosts playbooks/deploy.yaml --vault-id vaultid --tags base
#
# Tags:
#   base, ddclient, wireguard, nginx, website, samba
#   nextcloud, monitoring (these all depend on the nginx tag)
#
# Install:
#   git submodule update --remote --merge
#   python3 -m venv ~/venv/ansible
#   source $HOME/venv/ansible/bin/activate
#   pip install --upgrade pip
#   pip install 'ansible<2.10' 'jmespath'
#   ansible-galaxy install -r requirements.yml
#   ansible-galaxy collection install -r requirements.yml
#
# Assumptions:
# Run apt update, upgrade
# Run rpi-update
# HD, SSD formatted appropriately.
---


- hosts: compute
  gather_facts: false
  tags: 'ddclient'
  become: true
  roles:
    - role: ddclient
      vars:
        ddclient_proto: 'freedns'
        ddclient_user: '{{ vault_ddclient_user }}'
        ddclient_password: '{{ vault_ddclient_password }}'
        ddclient_domain: '{{ vpn_domain }}'

- hosts: compute
  gather_facts: false
  tags: 'wireguard'
  become: true
  roles:
    - role: wireguard
      vars:
        wireguard_server_priv_key: '{{ vault_wireguard_server_priv_key }}'
        wireguard_server_pub_key: 'iwsriL3AUn4dgKfsSNgJtj/G808k4jXvSC+mM70YnAw='
        wireguard_server_listen_port: 51820
        wireguard_server_ip: '192.168.10.1/24'
        wireguard_peers:
          - peer_ip: '192.168.10.2/32'  # my phone
            peer_key: '/mFv6y9QA8dhX/A9fFn+mzg/SZq4BZPeNofm1w754y8='
          - peer_ip: '192.168.10.3/32'  # personal laptop
            peer_key: '6+t6FbEHSAOuzBtQwb0bDqfFa5Kvfkb2QIUGpRKA5Eg='
          - peer_ip: '192.168.10.4/32'  # vps
            peer_key: 'oz2jxeSUWD4r5g3y7XuSItqSiqOOJz8vulYYVXAsKS8='

- hosts: compute
  gather_facts: false
  tags: 'nginx'
  become: true
  roles:
    - role: nginx
      vars:
        nginx_website_domains: '{{ ["default"] + (nginx_websites | map(attribute="name") | list) }}'
        nginx_global_apps_domain: '{{ apps_domain }}'
        nginx_apps_confs: '{{ apps_conf_map | dict2items(key_name="app", value_name="conf") }}'

- hosts: compute
  gather_facts: false
  tags: 'website'
  become: true
  roles:
    - role: website
      vars:
        websites: '{{ nginx_websites }}'
        git_user: '{{ vault_git_user }}'
        git_pass: '{{ vault_git_password }}'

- hosts: compute
  gather_facts: false
  tags: 'nextcloud'
  become: true
  roles:
    - role: nextcloud
      vars:
        nextcloud_domain: '{{ apps_conf_map["nextcloud"]["access_domain"] }}'
        nextcloud_host_port: '{{ apps_conf_map["nextcloud"]["port"] }}'
        nextcloud_data_root: '{{ data_vol_hdd }}/nextcloud'
        nextcloud_postgres_password: '{{ vault_nextcloud_postgres_password }}'

- hosts: compute
  gather_facts: false
  tags: 'searxng'
  become: true
  roles:
    - role: searxng
      vars:
        searxng_domain: '{{ apps_conf_map["searxng"]["access_domain"] }}'
        searxng_host_port: '{{ apps_conf_map["searxng"]["port"] }}'
        searxng_data_root: '{{ data_vol_hdd }}/searxng'
        searxng_secret_key: '{{ vault_searxng_secret_key }}'

- hosts: compute
  gather_facts: false
  tags: 'bitwarden'
  become: true
  roles:
    - role: bitwarden
      vars:
        bitwarden_host_port: '{{ apps_conf_map["bitwarden"]["port"] }}'
        bitwarden_data_dir: '{{ data_vol_hdd }}/bitwarden'

# Access: http://art-jr/data
- hosts: compute
  gather_facts: false
  tags: 'samba'
  become: true
  roles:
    - role: samba
      vars:
        samba_user: '{{ vault_samba_user }}'
        samba_user_pass: '{{ vault_samba_password }}'

- hosts: compute
  become: true
  tags: 'monitoring'
  roles:
    - role: 'cloudalchemy.node_exporter'
      vars:
        node_exporter_version: '1.2.2'
        node_exporter_web_listen_address: '0.0.0.0:9100'
        node_exporter_web_telemetry_path: '/metrics'

    # monitor cpu temp. stats for the rpi.
    - role: 'rpi_exporter'

    - role: 'cloudalchemy.prometheus'
      vars:
        prometheus_version: 'latest'
        prometheus_skip_install: false
        prometheus_db_dir: '{{ data_vol_hdd }}/prometheus'
        prometheus_web_listen_address: '0.0.0.0:{{ apps_conf_map["prometheus"]["port"] }}'
        prometheus_web_external_url: 'https://{{ apps_conf_map["prometheus"]["access_domain"] }}'
        prometheus_storage_retention: '15d'
        prometheus_global:
          scrape_interval: '30s'
          evaluation_interval: '30s'
        prometheus_targets:
          node:
            - targets:
                - localhost:9100
                - localhost:9243
              labels:
                env: prod
        prometheus_scrape_configs:
          - job_name: "prometheus"
            metrics_path: "{{ prometheus_metrics_path }}"
            static_configs:
              - targets:
                  - "{{ ansible_fqdn | default(ansible_host) | default('localhost') }}:9090"
          - job_name: "node"
            file_sd_configs:
              - files:
                  - "{{ prometheus_config_dir }}/file_sd/node.yml"
          - job_name: 'blackbox'
            metrics_path: /probe
            params:
              module: [http_2xx]
            static_configs:
              # all apps, nginx websites, prefixed with "https://"
              - targets: '{{ ["https://"] | product((apps_conf_map | dict2items(key_name="app", value_name="conf") | map(attribute="conf") | map(attribute="access_domain") | list)+(nginx_websites | map(attribute="name") | list)) | map("join") | list }}' # noqa yaml
            relabel_configs:
              - source_labels: [__address__]
                target_label: __param_target
              - source_labels: [__param_target]
                target_label: instance
              - target_label: __address__
                replacement: 127.0.0.1:9115  # Blackbox exporter.

    - role: 'cloudalchemy.blackbox-exporter'
      vars:
        blackbox_exporter_web_listen_address: '0.0.0.0:9115'

- hosts: compute
  become: true
  tags: 'base'
  roles:
    - role: geerlingguy.pip
      vars:
        pip_package: python3-pip
        pip_install_packages:
          - name: docker
          - name: pexpect

    - role: geerlingguy.docker_arm
      vars:
        docker_install_recommends: true
        docker_install_compose: true
        docker_users:
          - pi
        docker_pip_executable: pip3
        docker_version_armv7: 5:20.10.10~3-0~raspbian-bullseye

    - role: geerlingguy.nfs
      vars:
        nfs_exports:
          - '{{ data_vol_ssd }} *(rw,sync,no_root_squash)'
          - '{{ data_vol_hdd }} *(rw,sync,no_root_squash)'
  pre_tasks:
    - name: 'Install quality of life packages are present'
      apt:
        name:
          - 'git'
          - 'net-tools'
          - 'neofetch'
          - 'neovim'
          - 'nnn'
          - 'nmap'
        update_cache: true

    - name: 'Ensure that mount for data vol exists'
      mount:
        state: 'mounted'
        path: '{{ item.vol_path }}'
        src: 'UUID="{{ item.vol_uuid }}"'
        boot: true
        fstype: '{{ item.vol_fstype }}'
        opts: 'rw,user,exec'
      loop:
        - vol_path: '{{ data_vol_ssd }}'
          vol_uuid: '734d1190-b222-4979-91c8-0582e030fd1a'
          vol_fstype: 'ext4'
        - vol_path: '{{ data_vol_hdd }}'
          vol_uuid: 'aa392d86-bc93-4ad4-9e9e-c1274384bbfb'
          vol_fstype: 'ext4'

    - name: 'Set python3 as default python'
      alternatives:
        name: 'python'
        path: '/bin/python3'