#!/usr/bin/env ansible-playbook
# vim:ft=ansible:
---
# Home media storage Pi
- hosts: pi-media-1.desu.ltd
  module_defaults:
    docker_container:
      state: started
      restart_policy: unless-stopped
      pull: yes
  tasks:
    - name: assure mount directory
      file: path=/data state=directory mode=0755
      tags: [ pis, storage ]
    - name: assure mount
      mount: path=/data src=LABEL=mass state=mounted fstype=ext4
      tags: [ pis, storage ]
    - name: assure directories in mount
      file: path=/data/{{ item }} state=directory mode=0755
      with_items:
        - nfs
        - postgresql
      tags: [ pis, storage ]
    - name: assure symlinks to directories in mount
      file: path={{ item.path }} src=/data/{{ item.src }} state=link
      with_items:
        - { path: /var/lib/postgresql, src: postgresql }
        - { path: /srv/nfs, src: nfs }
      tags: [ pis, storage ]
    - name: ensure docker network
      docker_network: name=web
      tags: [ docker ]
    - name: ensure docker nginx config
      copy:
        dest: /data/nginx/conf.d/vhosts.conf
        mode: "0644"
        content: |
          server {
            listen 80 default_server;
            server_name transmission.local.desu.ltd;
            location / {
              proxy_set_header Host $host;
              proxy_set_header X-Real-IP $remote_addr;
              proxy_pass http://transmission:9091;
            }
          }
          server {
            listen 80;
            server_name jackett.local.desu.ltd;
            location / {
              proxy_set_header Host $host;
              proxy_set_header X-Real-IP $remote_addr;
              proxy_pass http://jackett:9117;
            }
          }
          server {
            listen 80;
            server_name sonarr.local.desu.ltd;
            location / {
              proxy_set_header Host $host;
              proxy_set_header X-Real-IP $remote_addr;
              proxy_pass http://sonarr:8989;
            }
          }
          server {
            listen 80;
            server_name radarr.local.desu.ltd;
            location / {
              proxy_http_version 1.1;
              proxy_set_header Upgrade $http_upgrade;
              proxy_set_header Connection $http_connection;
              proxy_set_header Host $host;
              proxy_set_header X-Real-IP $remote_addr;
              proxy_pass http://radarr:7878;
            }
          }
      tags: [ docker, ingress ]
    - name: include tasks for apps
      include_tasks: tasks/app/{{ task }}
      with_items:
        - redis.yml
      loop_control:
        loop_var: task
      tags: [ always ]
    - name: include tasks for web services
      include_tasks: tasks/web/{{ task }}
      with_items:
        - transmission.yml
        - jackett.yml
        - sonarr.yml
        - radarr.yml
        - ingress-insecure.yml
      loop_control:
        loop_var: task
      tags: [ always ]
  roles:
    - role: backup
      vars:
        backup_s3backup_list_extra:
          - /data/transmisson
          - /data/jackett
          - /data/sonarr
        backup_time: "Mon *-*-* 02:00:00"
      tags: [ backup ]
    - role: geerlingguy.postgresql
      vars:
        postgresql_global_config_options:
          - option: listen_addresses
            value: 192.168.103.1,172.23.103.1,127.0.0.1
        postgresql_hba_entries:
          - { type: local, database: all, user: postgres, auth_method: peer }
          - { type: local, database: all, user: all, auth_method: md5 }
          - { type: host, database: all, user: all, address: '127.0.0.0/8', auth_method: md5 }
          - { type: host, database: all, user: all, address: '::1/128', auth_method: md5 }
            # Used for internal access from other nodes
          - { type: host, database: all, user: all, address: '192.168.0.0/16', auth_method: md5 }
            # Allow hosts over zerotier
          - { type: host, database: all, user: all, address: '172.23.0.0/16', auth_method: md5 }
        postgresql_users:
          - name: grafana
            password: "{{ secret_grafana_local_db_pass }}"
          - name: gulagbot
            password: "{{ secret_gulagbot_local_db_pass }}"
          - name: firefly
            password: "{{ secret_firefly_db_pass }}"
          - name: nagios
            password: "{{ secret_postgresql_monitoring_password }}"
        postgresql_databases:
          - name: gulagbot
            owner: gulagbot
          - name: grafana
            owner: grafana
          - name: firefly
            owner: firefly
      tags: [ pis, storage, psql ]
    - role: geerlingguy.nfs
      vars:
        nfs_exports:
          - "/data/shared/media    192.168.0.0/16(ro,no_root_squash,sync) 172.23.0.0/16(ro,no_root_squash,sync)"
      tags: [ pis, storage, nfs ]