ansible/site.yml

---

- name: Configure local repository
  hosts: 127.0.0.1
  connection: local
  gather_facts: no
  tasks:
    - name: Create local directory for credentials & keys
      file:
        path: "{{ item }}"
        owner: "{{ global_local_user }}"
        group: "{{ global_local_user }}"
        mode: "u=rwx,g=rx,o=rx"
        state: directory
      loop:
        - "{{ global_credentials_directory }}"
        - "{{ global_public_key_directory }}"
        - "{{ global_ssh_key_directory }}"
        - "{{ global_ssh_host_key_directory }}"
        - "{{ global_wireguard_private_directory }}"
        - "{{ global_wireguard_public_directory }}"
    - name: Install required tools
      become: yes
      become_user: root
      become_method: sudo
      apt:
        name:
          - sshpass
          - wireguard-tools
        state: present

- name: Configure secure root access to hosts
  hosts: bootstrap
  gather_facts: no
  roles:
    - role: bootstrap

- hosts: all
  strategy: free
  roles:
    - role: hostname
      fqdn: "{{ inventory_hostname }}"
    - role: common
    - role: account
      username: "zocker"
      password: "{{ zocker_password }}"
      authorized_keys: "{{ zocker_authorized_keys_url }}"
      sudo: yes

- name: Configure wireguard network
  import_playbook: playbooks/wireguard.yml

- name: Configure nvak
  tags:
    - test
  hosts: nvak.banananet.work
  vars:
    nvak_dns_slaves: []
  pre_tasks:
    - name: Load ssh host key dns fingerprint for host
      command: cat "{{ global_ssh_host_key_directory | quote }}/{{ item | quote }}/dns"
      delegate_to: localhost
      register: ssh_key_dns_fpr_raw
      changed_when: False
      loop: "{{ groups['all'] }}"
    - name: Remap ssh host key dns fingerprints
      set_fact:
        ssh_key_dns_fpr_map: "{{ ssh_key_dns_fpr_raw.results | items2dict(key_name='item', value_name='stdout') }}"
  roles:
    - role: dns/master
      domain: banananet.work
      main_nameserver_domain: ns1.banananet.work.
      responsible_mail_name: admin.banananet.work.
      slaves: "{{ nvak_dns_slaves }}"
      entries: |
        ; Name Servers
        @ IN NS ns1
        ns1 IN A {{ ansible_default_ipv4.address }}
        ns1 IN AAAA {{ ansible_default_ipv6.address }}
        ; Automatic server addresses
        {% for fqdn in groups['public_available'] %}
        {{ fqdn }}. IN A {{ hostvars[fqdn].ansible_default_ipv4.address }}
        {{ fqdn }}. IN AAAA {{ hostvars[fqdn].ansible_default_ipv6.address }}
        {{ ssh_key_dns_fpr_map[fqdn] }}
        {% endfor %}
        ; Public use domains
        @ IN A {{ ansible_default_ipv4.address }}
        @ IN AAAA {{ ansible_default_ipv6.address }}
        auth IN CNAME nvak
        cloud IN CNAME nvak
        test.cloud IN CNAME nvak
        dsa IN CNAME nvak
        firefox IN CNAME nvak
        git IN CNAME nvak
        keys IN CNAME rurapenthe
        rss IN CNAME nvak
        wg IN CNAME nvak
        ; Mail
        @ IN MX 10 nvak
        @ IN TXT "v=spf1 +mx -all"
        mail IN CNAME nvak
        imap IN CNAME nvak
        smtp IN CNAME nvak
    - role: dns/master
      domain: forumderschan.de
      main_nameserver_domain: ns1.banananet.work.
      responsible_mail_name: admin.banananet.work.
      slaves: "{{ nvak_dns_slaves }}"
      entries: |
        ; Name Servers
        @ IN NS ns1.banananet.work.
        @ IN NS ns2.banananet.work.
        ; WebPage
        @ IN A {{ ansible_default_ipv4.address }}
        @ IN AAAA {{ ansible_default_ipv6.address }}
        www IN A {{ ansible_default_ipv4.address }}
        www IN AAAA {{ ansible_default_ipv6.address }}
        ; Mail
        @ IN MX 10 nvak
        @ IN TXT "v=spf1 +mx -all"
    - role: dns/master
      domain: spotme.fun
      main_nameserver_domain: ns1.banananet.work.
      responsible_mail_name: admin.banananet.work.
      slaves: "{{ nvak_dns_slaves }}"
      entries: |
        ; Name Servers
        @ IN NS ns1.banananet.work.
        @ IN NS ns2.banananet.work.
        ; Web Page
        @ IN A {{ ansible_default_ipv4.address }}
        @ IN AAAA {{ ansible_default_ipv6.address }}
        www IN A {{ ansible_default_ipv4.address }}
        www IN AAAA {{ ansible_default_ipv6.address }}
        ; Mail
        @ IN MX 10 nvak
        @ IN TXT "v=spf1 +mx -all"
    - role: dns/master
      domain: stadtpiraten-karlsruhe.de
      main_nameserver_domain: ns1.banananet.work.
      resposible_mail_name: admin.banananet.work.
      slaves: "{{ nvak_dns_slaves }}"
      entries: |
        ; Name Servers
        @ IN NS ns1.banananet.work.
        @ IN NS ns2.banananet.work.
        ; WebPages
        @ IN A {{ ansible_default_ipv4.address }}
        @ IN AAAA {{ ansible_default_ipv6.address }}
        www IN A {{ ansible_default_ipv4.address }}
        www IN AAAA {{ ansible_default_ipv6.address }}
        forum IN A {{ ansible_default_ipv4.address }}
        forum IN AAAA {{ ansible_default_ipv6.address }}
        ; Mail
        @ IN MX 10 nvak
        @ IN TXT "v=spf1 +mx -all"
    # Git Server
    - role: server/gitea
      domain: git.banananet.work
      gitea_system_user: git
    # Banananet.work
    - role: server/static
      domain: banananet.work
      repo: git@git.banananet.work:banananetwork/main-static.git
    # SpotMe Server
#    - role: server/spotme
#      domain: spotme.fun
#      spotme_system_user: spotme
#    # Admin Panel
#    - role: server/php
#      domain: nvak.banananet.work
#      repo: PHPMYADMIN # TODO
    # BananaNetwork Keys
    - role: server/node
      domain: keys.banananet.work
      repo: git@git.banananet.work:banananetwork/keys.git
      app_port: 12822
      system_user: keys-banananet-work
    # Nextcloud Server
    - role: server/nextcloud
      domain: cloud.banananet.work
      system_user: nextcloud
      nextcloud_admin_user: zocker
      nextcloud_admin_pass: "{{ zocker_password }}"
      enabled_apps_list:
        - accessibility
        - activity
        - admin_audit
        - apporder
        - bruteforcesettings
        - calendar
        - checksum
        - cloud_federation_api
        - comments
        - contacts
        - cookbook
        - cospend
        - dav
        - deck
        - dicomviewer
        - external
        - federatedfilesharing
        - federation
        - files
        - files_automatedtagging
        - files_ebookreader
        - files_external
        - files_markdown
        - files_pdfviewer
        - files_readmemd
        - files_rightclick
        - files_sharing
        - files_texteditor
        - files_trashbin
        - files_versions
        - files_videoplayer
        - firstrunwizard
        - gallery
        - logreader
        - lookup_server_connector
        - mail
        - metadata
        - nextcloud_announcements
        - notes
        - notifications
        - oauth2
        - ocdownloader
        - password_policy
        - phonetrack
        - polls
        - privacy
        - provisioning_api
        - quota_warning
        - serverinfo
        - sharebymail
        - sharerenamer
        - social
        - sociallogin
        - socialsharing_email
        - spreed
        - support
        - suspicious_login
        - systemtags
        - tasks
        - theming
        - twofactor_admin
        - twofactor_backupcodes
        - twofactor_gateway
        - twofactor_nextcloud_notification
        - twofactor_totp
        - twofactor_u2f
        - updatenotification
        - viewer
        - workflowengine
      disabled_apps_list:
        - encryption
        - recommendations
        - survey_client
        - user_ldap
    # Firefox Sync Server
    - role: server/firefox-sync
      domain: firefox.banananet.work
    # RSS Server
    # TODO Manual initialization of database required
    - role: server/tt-rss
      domain: rss.banananet.work
    # DSA Seite
#    - role: server/node
#      domain: dsa.banananet.work
#      repo: git@git.banananet.work:dsaGroup/dsaPage.git
#      app_port: 12821
#      system_user: dsaPage
    # Forum der Schande
    - role: server/php
      domain: forumderschan.de
      repo: git@git.banananet.work:strichliste/strichliste-php.git
      root: html
      installation_includes:
        - includes
    - role: nginx/forward
      domain: www.forumderschan.de
      dest: forumderschan.de
    # WG Nextcloud
    - role: server/nextcloud
      domain: wg.banananet.work
      nextcloud_admin_user: felix
      enabled_apps_list:
        - accessibility
        - activity
        - apporder
        - bruteforcesettings
        - calendar
        - checksum
        - cloud_federation_api
        - comments
        - contacts
        - cookbook
        - cospend
        - dav
        - deck
        - encryption
        - external
        - federatedfilesharing
        - federation
        - files
        - files_automatedtagging
        - files_ebookreader
        - files_external
        - files_markdown
        - files_pdfviewer
        - files_readmemd
        - files_rightclick
        - files_sharing
        - files_texteditor
        - files_trashbin
        - files_versions
        - files_videoplayer
        - firstrunwizard
        - gallery
        - logreader
        - lookup_server_connector
        - metadata
        - nextcloud_announcements
        - notes
        - notifications
        - oauth2
        - ocdownloader
        - password_policy
        - polls
        - privacy
        - provisioning_api
        - quota_warning
        - serverinfo
        - sharebymail
        - sharerenamer
        - sociallogin
        - socialsharing_email
        - spreed
        - support
        - suspicious_login
        - systemtags
        - tasks
        - theming
        - twofactor_admin
        - twofactor_backupcodes
        - twofactor_gateway
        - twofactor_nextcloud_notification
        - twofactor_totp
        - twofactor_u2f
        - updatenotification
        - viewer
        - workflowengine
      disabled_apps_list:
        - admin_audit
        - recommendations
        - survey_client
        - user_ldap
#    # Stadtpiraten
#    - role: server/typo3
#      domain: piraten.dev.banananet.work
#    - role: server/php
#      domain: forum.piraten.dev.banananet.work
#      repo: PHPBB # TODO
#      version: master
#    # Stadtpiraten (prod)
#    - role: nginx/forward
#      domain: www.stadtpiraten-karlsruhe.de
#      dest: stadtpiraten-karlsruhe.de

- name: Configure rurapenthe
  hosts: rurapenthe.banananet.work
  roles:
#    - role: dns/slave
#      domain: banananet.work
#      masters:
#        - nvak.banananet.work
#    - role: dns/slave
#      domain: forumderschan.de
#      masters:
#        - nvak.banananet.work
#    - role: dns/slave
#      domain: stadtpiraten-karlsruhe.de
#      masters:
#        - nvak.banananet.work
#    - role: dns/slave
#      domain: spotme.fun
#      masters:
#        - nvak.banananet.work
    - role: server/node
      domain: keys.banananet.work
      repo: git@git.banananet.work:banananetwork/keys.git
      app_port: 12822
      system_user: keys-banananet-work
      environment_vars:
        REGISTER_PASS: "{{ global_ip_discover_register_pass }}"

#- hosts: 192.168.1.8 # hardie.khitomer.banananet.work
#  roles:
#    - role: mysql/application