site.yml

---
# file: site.yml
- hosts: web_servers
  remote_user: '{{ glass_user }}'
  become: yes

  tasks:
  #role:base
  - name: Install essential utils
    apt: name={{ item }} state=latest
    with_items:
      - nano
      - joe
      - git
      - vim
      - emacs
      - screen
      - tmux
      - molly-guard
      - links
      - eatmydata
      - etckeeper
      - mlocate
      - man-db
      - parallel
      - bmon
      - dstat
      - strace
      - pv
      - time
      - devscripts

  - name: Set timezone
    timezone:
      name: Australia/Perth

  - name: Set nano as default editor
    alternatives:
      name: editor
      path: /bin/nano

  - name: Install build-essential
    apt: name=build-essential state=latest

  - name: Create bin directory in /root/ for storing util scripts
    file:
      path: /root/bin
      state: directory
      owner: root
      group: root
      mode: 0700
      recurse: yes

  - name: Apt - enable stretch-backports
    apt_repository:
      repo: "deb http://mirrors.digitalocean.com/debian stretch-backports main contrib non-free"
      state: present
      filename: stretch-backports
      update_cache: yes

  #role:dns-servers
  - name: DNS - Install Knot DNS
    apt: name=knot state=present

  - name: DNS - Configure Knot DNS
    template:
      src: dns/knot.conf.j2
      dest: /etc/knot/knot.conf
      owner: knot
      group: knot
      mode: '0640'
    notify: reload knot

  - name: DNS - Add example plug.org.au zonefile
    template: src=dns/plug.org.au.example.zone.j2 dest=/etc/knot/plug.org.au.example.zone owner=knot group=knot mode=0644

  #role:nginx
  # Currently disabled as handled in/by mail_servers
  #- name: Install nginx
  #  apt: name=nginx state=latest
  #
  #- name: Configure nginx
  #  template: src=nginx/nginx.conf dest=/etc/nginx/nginx.conf
  #  notify:
  #  - reload nginx
  #
  #- name: Configure default webpage
  #  template: src=nginx/default.html dest=/var/www/html/index.html

  #role:letsencrypt
  - name: Install certbot
    apt: name=certbot state=latest

  - name: Install certbot nginx plugin
    apt: name=python-certbot-nginx state=latest

  - name: Install certbot DNS RFC2136 plugin
    apt:
      name: python3-certbot-dns-rfc2136
      state: present
      default_release: stretch-backports

  - name: Create certbot secrets and config folder
    file:
      path: /root/.secrets/certbot/
      state: directory
      owner: root
      group: root
      mode: '0600'

  - name: Configure certbot rfc2136 plugin
    template:
      src: letsencrypt/rfc2136.ini.j2
      dest: /root/.secrets/certbot/rfc2136.ini
      owner: root
      group: root
      mode: '0600'

  #role:borgbackup
  - name: Install Borg backup utility and dependencies
    apt: name={{ item }} state=latest
    with_items:
      - borgbackup
      - fuse

  - name: Create Borg backup script
    template:
      src: borgbackup/borgauto.sh.j2
      dest: /root/bin/borgauto.sh
      owner: root
      group: root
      mode: 0700

  - name: Create Borg restore script
    template:
      src: borgbackup/brestore.sh.j2
      dest: /root/bin/brestore.sh
      owner: root
      group: root
      mode: 0700

  - name: Ensure Borg log file directory exists
    file:
      path: /var/log/borgbackup/
      state: directory
      owner: root
      group: adm
      mode: 0755

  - name: SSH - Install borg private key per machine
    template:
      src: secrets/ssh/borgkey-{{ ansible_hostname }}
      dest: /root/.ssh/borgkey
      owner: root
      group: root
      mode: 0600

  - name: SSH - Install borg public key per machine
    template:
      src: secrets/ssh/borgkey-{{ ansible_hostname }}.pub
      dest: /root/.ssh/borgkey.pub
      owner: root
      group: root
      mode: 0600

  #role:plug-website
  # jekyll install disabled temporarily until we move to buster
  #  - name: Install jekyll
  #    apt: name=jekyll state=latest

  - name: Use Git to checkout latest plug website
    git: version="master" repo="https://github.com/plugorgau/plugorgau.github.io.git" dest="/home/glass/plugorgau.github.io/"
    become_user: glass
    register: plug_website_git

  - name: Use Jekyll to build plug website
    shell: "jekyll build"
    args: 
      chdir: /home/glass/plugorgau.github.io/
    become_user: glass
    when: plug_website_git.changed
    register: plug_website_new_build

  - name: Use rsync + a script to destructively update running site
    shell: bash /home/glass/plugorgau.github.io/deploy.sh
    when: plug_website_new_build.changed

#  - name: Use rsync destructively to update running site
#    synchronize:
#      src: /home/glass/plugorgau.github.io/_site/
#      dest: /var/www/bayonet.plug.org.au/
#      delete: yes
#      recursive: yes
#    become_user: www-data
#    when: plug_website_new_build.changed

  - name: Website - install nginx redirect map
    template:
      src: plug-website/redirects.map
      dest: /etc/nginx/redirects.map
    notify: reload nginx

  - name: Install nginx site config
    template: 
      src: plug-website/plug.org.au.conf
      dest: /etc/nginx/sites-available/plug.org.au.conf
    notify: reload nginx

  - name: Enable nginx site config
    file:
      state: link 
      src: ../sites-available/plug.org.au.conf
      dest: /etc/nginx/sites-enabled/plug.org.au.conf
    notify: reload nginx

  #role:ldap
  - name: Install LDAP server
    apt: name=slapd state=latest

  - name: Install useful LDAP utils
    apt: name=ldap-utils state=latest

  - name: Create LDAP automatic backup script
    template:
      src: ldap/20-ldapdump
      dest: /etc/cron.daily/20-ldapdump
      owner: root
      group: root
      mode: 0755

  - name: Create directory to house LDAP backups
    file:
      path: /var/backups/slapd
      state: directory
      owner: root
      group: root
      mode: 0700
      recurse: yes

  #role:php
  - name: PHP - Install php-fpm
    apt: name=php7.0-fpm
    # TODO Configure php-fpm

  #role:ugmm
  - name: UGMM - Install smarty3 templating engine
    apt: name=smarty3 state=latest

  - name: UGMM - Install LDAP PHP module
    apt: name=php7.0-ldap state=latest
    # TODO nginx cofig
    # TODO php pool?

  #role:fail2ban
  - name: Install fail2ban and dependencies
    apt: name={{ item }} state=latest
    with_items:
      - fail2ban
      - python3-pyinotify

  - name: Configure fail2ban
    template: src=fail2ban/jail.local.j2 dest=/etc/fail2ban/jail.local
    notify: reload fail2ban

  #role:mumble-servers
  - name: Install Mumble
    apt: name=mumble-server state=latest

  - name: Set mumble SSL
    # https://stackoverflow.com/questions/24334115/ansible-lineinfile-for-several-lines
    lineinfile:
      name: /etc/mumble-server.ini
      regexp: "^#? *{{ item.key | regex_escape() }}="
      line: "{{ item.key }}={{ item.value }}"
    with_dict:
      'sslCert': '/etc/letsencrypt/live/plug.org.au/fullchain.pem'
      'sslKey': '/etc/letsencrypt/live/plug.org.au/privkey.pem'
    notify: restart mumble-server

  #role:icecast
  - name: Install Icecast
    apt: name=icecast2 state=latest

  - name: Configure Icecast
    template:
      src: icecast/icecast.xml.j2
      dest: /etc/icecast2/icecast.xml
      owner: icecast2
      group: icecast
      mode: 0660
    notify: restart icecast

  - name: Enable Icecast
    lineinfile:
      name: /etc/default/icecast2
      regexp: '^ENABLE='
      line: 'ENABLE=true'
    notify: start icecast

  #role:mailman
  - name: Mailman - Install Mailman and fcgiwrap
    apt: name={{ item }} state=latest
    with_items:
      - mailman
      - fcgiwrap

  - name: Mailman - Configure mailman URLs
    template:
      src: mailman/mm_cfg.py.j2
      dest: /etc/mailman/mm_cfg.py
    notify: reload mailman

  - name: Mailman - Install nginx redirect map
    template:
      src: mailman/redirects-lists.map
      dest: /etc/nginx/redirects-lists.map
    notify: reload nginx

  - name: Mailman - Install nginx site config
    template:
      src: mailman/lists.plug.org.au.conf
      dest: /etc/nginx/sites-available/lists.plug.org.au.conf
    notify: reload nginx

  - name: Mailman - Enable nginx site config
    file:
      state: link
      src: ../sites-available/lists.plug.org.au.conf
      dest: /etc/nginx/sites-enabled/lists.plug.org.au.conf
    notify: reload nginx

  #TODO: Move this to its own file
  handlers:
    - name: reload nginx
      service: name=nginx state=reloaded

#      notify: install certbot nginx plugin
#    - name: install certbot nginx plugin
#      apt: name=python-certbot-nginx state=latest

    - name: reload knot
      service: name=knot state=reloaded

    - name: reload mailman
      service: name=mailman state=reloaded

    - name: reload fail2ban
      service: name=fail2ban state=reloaded

    - name: start icecast
      service: name=icecast2 state=started

    - name: restart icecast
      service: name=icecast2 state=restarted

    - name: restart mumble-server
      service: name=mumble-server state=restarted

- import_playbook: mail_servers.yml