ansible-edda/playbooks/baldur.yml

---
- name: "all"
  hosts: "all"

  tasks:
    - name: "block domains"
      ansible.builtin.lineinfile:
        path: "/etc/hosts"
        line: "{{ address }} {{ item }}"
      vars:
        address: "{{ hostvars[item.split('.')[0]].ansible_default_ipv4.address |
                     default('127.0.0.1') }}"
      loop: "{{ [system_mail_smtp_server | default([])] |
                union( [vpn_wireguard_server_address | default([])] ) |
                union( [backups_restic_user_aws_bucket_endpoint | default([])] ) |
                flatten }}"
      when: not (the_nine_worlds_production | bool)
      tags: "always"

- name: "baldur"
  hosts: "baldur"
  vars_files:
    - "vars/services/volumes.yml"
    - "vars/services/deploy/versions.yml"

  roles:
    # ----------------------------------------------------------------------------------------------
    # system
    # ----------------------------------------------------------------------------------------------
    - role: "system/base/nftables"
      tags:
        - "system:base"
        - "system:base:nftables"
    - role: "system/base/sshd"
      tags:
        - "system:base"
        - "system:base:sshd"
    - role: "system/base/ntp"
      tags:
        - "system:base"
        - "system:base:ntp"
    - role: "system/base/fail2ban"
      tags:
        - "system:base"
        - "system:base:fail2ban"
    - role: "system/base/utils"
      tags:
        - "system:base"
        - "system:base:utils"
    - role: "system/base/root"
      tags:
        - "system:base"
        - "system:base:root"
    - role: "system/base/user"
      tags:
        - "system:base"
        - "system:base:user"
      vars:
        system_base_user_become_user: "{{ system_base_ssh_user }}"
    - role: "system/directories"
      tags: "system:directories"
      vars:
        system_directories_create_etc: true
        system_directories_create_var: true

    # ----------------------------------------------------------------------------------------------
    # backups
    # ----------------------------------------------------------------------------------------------
    - role: "backups/restic/setup"
      tags: "backups:restic:setup"

    # ----------------------------------------------------------------------------------------------
    # music
    # ----------------------------------------------------------------------------------------------
    - role: "music/user"
      tags: "music:user"
      vars:
        music_user_public_key_file: "~/.ssh/debian-virt.pub"
    - role: "music/collection"
      tags: "music:collection"
    - role: "backups/restic/user"
      vars:
        backups_restic_user_name: "{{ music_user_name }}"
        backups_restic_user_use_dataset: "{{ 'zfs' in group_names }}"
        backups_restic_user_data_dataset: "{{ music_user_data_dataset | default('') }}"
        backups_restic_user_data_directory: "{{ music_user_data_directory }}"
        backups_restic_user_data_exclude_list: []
        backups_restic_user_aws_bucket_prefix: "the-nine-worlds---{{ music_user_name }}"
      tags:
        - "music:backups"
        - "music:backups:restic"
        - "music:backups:restic:user"

    # ----------------------------------------------------------------------------------------------
    # vpn
    # ----------------------------------------------------------------------------------------------
    - role: "vpn/base"
      tags: "vpn:base"
    - role: "vpn/bridge"
      tags: "vpn:bridge"

    # ----------------------------------------------------------------------------------------------
    # services
    # ----------------------------------------------------------------------------------------------
    - role: "services/setup/system"
      tags:
        - "services:setup"
        - "services:setup:system"

  tasks:
    - name: "setup : user"
      ansible.builtin.include_role:
        name: "services/setup/user"
        apply:
          tags:
            - "services:{{ services_service_name }}"
            - "services:setup"
            - "services:setup:user"
            - "services:setup:user:{{ services_service_name }}"
            - "services:{{ services_service_name }}:setup:user"
      vars:
        services_service_volumes: "{{ services_volumes[services_service_name] }}"
      loop: "{{ services_host_services | dict2items | map(attribute='key') }}"
      loop_control:
        loop_var: "services_service_name"
      tags: "always"

    - name: "deploy rproxy"
      ansible.builtin.include_role:
        name: "services/deploy/rproxy"
        apply:
          tags:
            - "services:rproxy"
            - "services:deploy"
            - "services:deploy:rproxy"
            - "services:rproxy:deploy"
      vars:
        services_service_name: "rproxy"
        services_deploy_rproxy_nginx_stream_config: "files/services/deploy/stream.conf"
        services_deploy_rproxy_nginx_subdomain_config_files:
          - "files/services/deploy/rproxy/nginx-conf.d/http-default.conf"
          - "files/services/deploy/rproxy/nginx-conf.d/wojciechkozlowski.eu.conf"
          - "files/services/deploy/rproxy/nginx-conf.d/www.wojciechkozlowski.eu.conf"
        services_service_deploy_versions: "{{ services_deploy_versions.rproxy }}"
      when: "'rproxy' in services_host_services"
      tags: "always"

    - name: "deploy lrproxy"
      ansible.builtin.include_role:
        name: "services/deploy/rproxy"
        apply:
          tags:
            - "services:lrproxy"
            - "services:deploy"
            - "services:deploy:lrproxy"
            - "services:lrproxy:deploy"
      vars:
        services_service_name: "lrproxy"
        services_deploy_rproxy_nginx_stream_config: "files/services/deploy/stream.conf"
        services_deploy_rproxy_nginx_subdomain_config_files:
          - "files/services/deploy/lrproxy/nginx-conf.d/archive.music.thenineworlds.net.conf"
          - "files/services/deploy/lrproxy/nginx-conf.d/cloud.wojciechkozlowski.eu.conf"
          - "files/services/deploy/lrproxy/nginx-conf.d/database.thenineworlds.net.conf"
          - "files/services/deploy/lrproxy/nginx-conf.d/git.thenineworlds.net.conf"
          - "files/services/deploy/lrproxy/nginx-conf.d/music.thenineworlds.net.conf"
          - "files/services/deploy/lrproxy/nginx-conf.d/notes.thenineworlds.net.conf"
        services_service_deploy_versions: "{{ services_deploy_versions.lrproxy }}"
      when: "'lrproxy' in services_host_services"
      tags: "always"

    - name: "deploy"
      ansible.builtin.include_role:
        name: "services/deploy/{{ services_service_name }}"
        apply:
          tags:
            - "services:{{ services_service_name }}"
            - "services:deploy"
            - "services:deploy:{{ services_service_name }}"
            - "services:{{ services_service_name }}:deploy"
      vars:
        services_service_deploy_versions: "{{ services_deploy_versions[services_service_name] }}"
      loop: "{{
        services_host_services | dict2items |
        rejectattr('key', '==', 'rproxy') |
        rejectattr('key', '==', 'lrproxy') |
        map(attribute='key') }}"
      loop_control:
        loop_var: "services_service_name"
      tags: "always"

    - name: "backups : restic"
      ansible.builtin.include_role:
        name: "backups/restic/user"
        apply:
          tags:
            - "services:{{ services_service_name }}"
            - "services:backups"
            - "services:backups:restic:user"
            - "services:backups:restic:user:{{ services_service_name }}"
            - "services:{{ services_service_name }}:backups:restic:user"
      vars:
        backups_restic_user_name: "\
          {{ services_backups_restic_services[services_service_name].user_name }}"
        backups_restic_user_use_dataset: "{{ 'zfs' in group_names }}"
        backups_restic_user_data_dataset: "\
          {{ services_backups_restic_services[services_service_name].data_dataset | default('') }}"
        backups_restic_user_data_directory: "\
          {{ services_backups_restic_services[services_service_name].data_directory }}"
        backups_restic_user_data_exclude_list: "\
          {{ services_backups_restic_services[services_service_name].exclude }}"
        backups_restic_user_aws_bucket_prefix: "\
          {{ services_backups_restic_services[services_service_name].aws_bucket_prefix }}"
      loop: "{{ services_host_services | dict2items | map(attribute='key') }}"
      when: "services_host_services[services_service_name].restic"
      loop_control:
        loop_var: "services_service_name"
      tags: "always"