- name: gate
  hosts: gate.vstill.cz
  vars:
    ansible_fqdn: gate.vstill.cz
    mail_relay: null
    pam_use_kerberos: False
    backports: False
    backports_git: False
    nftables_default_config: False
    upstream_syncthing: True
    openvpn_fi_start: False
    eth_internal:
      - eth0
    eth_external:
      - enx00e04c37e5aa
      - tun-fi
      - netbox6
      - tun0
    dhcpcd_extra: |
      debug

      # the metrics need to be set for the sake of routing/NAT
      interface eth0
      static ip_address=192.168.5.1/24
      static ip6_address=2a01:4240:5f52:b588::1/64
      metric 250

      # internet comes from here
      interface enx00e04c37e5aa
      metric 220

      interface tun-fi
      metric 600

      interface tun0
      metric 700

      interface netbox6
      metric 400
    net:
      ipv6_prefix: "2a01:4240:5f52:b588"
      fixed:
          # TP-Link Archer C7
        - name: tplink
          link: 50:C7:BF:F9:4E:77
          ipv4: 192.168.5.2
          # link: 50:C7:BF:F9:4E:78 # in router mode

        - name: x270wifi
          link: e4:70:b8:6b:dc:7b
          ipv4: 192.168.5.32
        - name: x270dock
          link: 34:d0:b8:c0:8b:7b
          ipv4: 192.168.5.33
        - name: x270
          link: 54:e1:ad:dc:a9:95
          ipv4: 192.168.5.34

        - name: t14
          link: 54:05:db:85:b5:43
          ipv4: 192.168.5.38

        - name: skund
          link: a8:a1:59:54:a9:af
          ipv4: 192.168.5.4

        - name: skund-old
          link: FC:AA:14:21:47:BF
          ipv4: 192.168.5.5

        - name: io
          link: dc:a6:32:f4:4b:5a
          ipv4: 192.168.5.6

        - name: x230
          link: 3C:97:0E:9E:B5:92
          ipv4: 192.168.5.35

        - name: x230w
          link: 6c:88:14:80:12:dc
          ipv4: 192.168.5.36


        - name: krull
          link: B8:27:EB:DC:7D:37
          ipv4: 192.168.5.3

        - name: pixma-mx925
          link: 60:12:8B:4D:AD:91
          ipv4: 192.168.5.16
#    nat:
#      ports:
#        - name: localhost
#          dst: 127.0.0.1
#          tcp:
#            - 22

  tasks:
    - fail:
        msg: possibly wrong server?
      when: ansible_distribution != 'Debian'

    - import_role:
        name: common_deb

    - import_role:
        name: vstill_deb

    - import_role:
        name: raspbian

    - name: IPv6 setup
      copy:
        src: dhcpcd-ipv6-netbox-hook
        dest: /lib/dhcpcd/dhcpcd-hooks/62-ipv6-netbox
      notify:
        - restart dhcpcd

    - name: "DHCPD: Install dhcp server"
      apt:
        pkg:
          - isc-dhcp-server

    - name: "DHCPD: block the original dhcpd service"
      systemd:
        enabled: true
        masked: true
        state: stopped
        name: isc-dhcp-server

    - name: "DHCPD: install new service files"
      copy:
        src: '{{item}}@.service'
        dest: '/etc/systemd/system/{{item}}@.service'
      loop:
        - dhcpd4
        - dhcpd6
      notify:
        - restart dhcpd
      register: dhcpd_service_updated

    - name: "DHCPD: user for the new services"
      user:
        name: dhcp
        home: /var/lib/dhcp
        shell: /usr/sbin/nologin
        system: true
      notify:
        - restart dhcpd

    - name: "DHCPD: allow write to leases dir"
      file:
        state: directory
        owner: dhcp
        group: dhcp
        path: /var/lib/dhcp/dhcp
      notify:
        - restart dhcpd

    - name: "DHCPD: create leases files"
      copy:
        content: ""
        force: no # do not create if exists
        owner: dhcp
        group: dhcp
        dest: '/var/lib/dhcp/{{item}}.leases'
      loop:
        - dhcpd
        - dhcpd6
      notify:
        - restart dhcpd

    - name: "DHCPD: Set config"
      template:
        src: '{{item}}.conf.j2'
        dest: '/etc/dhcp/{{item}}.conf'
      notify:
        - restart dhcpd
      loop:
        - dhcpd
        - dhcpd6

    - name: "DHCPD: (reload) enable dhcpd"
      service:
        daemon_reload: '{{dhcpd_service_updated.changed}}'
        enabled: '{{item.1 == "4"}}'
        name: 'dhcpd{{item.1}}@{{item.0}}'
      loop: '{{ eth_internal | product(["4", "6"]) | list }}'

    - name: "sysctl: enable IP forwarding"
      sysctl:
        name: '{{item}}'
        value: '1'
        sysctl_file: "/etc/sysctl.d/30-ipforward.conf"
        reload: yes
      loop:
        - net.ipv4.ip_forward
        - net.ipv6.conf.default.forwarding
        - net.ipv6.conf.all.forwarding

    - name: nftables set new config for validation
      template:
        src: nftables.conf.j2
        dest: /etc/nftables.new.conf

    - name: nftables validate config
      command: nft --check -f /etc/nftables.new.conf
      register: nftables_valid

    - name: nftables config
      template:
        src: nftables.conf.j2
        dest: /etc/nftables.conf
      notify:
        - restart nftables
      when: not nftables_valid.failed

    - name: "IPv6 Router Advertisement: install radvd"
      apt:
        pkg:
          - radvd

    - name: "IPv6 Router Advertisement: setup radvd"
      template:
        src: radvd.conf.j2
        dest: /etc/radvd.conf
      notify:
        - restart radvd

    - name: "IPv6 Router Advertisement: enable radvd"
      systemd:
        name: radvd
        enabled: true
      notify:
        - restart radvd

    - name: "DNS: install bind"
      apt:
        pkg:
          - bind9
      notify:
        - restart named

    - name: "DNS: setup config"
      template:
        src: 'bind/{{item}}.j2'
        dest: '/etc/bind/{{item}}'
      notify:
        - restart named
      loop:
        - 'named.conf.options'
        - 'named.conf.local'
        - 'p.vstill.cz.zone'
        - 'ip6.vstill.cz.zone'

    - name: Install ZNC
      apt:
        pkg:
          - znc
          - znc-dev
          - znc-backlog
#          - znc-push
#        default_release: buster-backports

    - name: ZNC user
      user:
        name: znc
        system: true

    - name: ZNC service
      copy:
        src: znc.service
        dest: /etc/systemd/system/znc.service
      notify:
        - enable znc

    - name: Web setup
      apt:
        pkg:
          - certbot

    - name: Dir for ZNC drop-in for certbot
      file:
        state: directory
        path: /etc/systemd/system/certbot.service.d

    - name: ZNC drop-in for certbot
      copy:
        dest: /etc/systemd/system/certbot.service.d/znc-setfacl.conf
        content: |
          [Service]
          ExecStart=/bin/bash -c '/usr/bin/setfacl -m u:znc:r-- /etc/letsencrypt/archive/msg.vstill.cz/privkey*.pem'
      register: certbot_znc

    - name: Reload systemd after installing ZNC drop-in
      systemd:
        daemon_reload: true
      when: certbot_znc.changed

    - name: Disk utils
      apt:
        pkg:
          - lvm2
          - cryptsetup-bin

    - name: Misc
      apt:
        pkg:
          - easy-rsa
          - gphoto2
          - gphotofs

    - name: "OpenVPN server user"
      user:
        name: openvpn
        home: /var/empty
        shell: /usr/sbin/nologin
        system: true

    - name: postfix
      apt:
        pkg:
          - postfix
          - libsasl2-modules
      notify: restart postfix

    - name: postfix config
      copy:
        src: gate/postfix/main.cf
        dest: /etc/postfix/main.cf
      notify:
        - restart postfix

    - name: Install NGINX
      apt:
        pkg:
          - nginx
          - python3-certbot-nginx
          - certbot

    - name: Extra utilities
      apt:
        pkg:
          - wakeonlan

  handlers:
    - name: restart dhcpd
      service:
        name: 'dhcpd{{item.1}}@{{item.0}}'
        state: restarted
      loop: '{{ eth_internal | product(["4"]) | list }}'

    - name: restart radvd
      service:
        name: radvd
        state: restarted

    - name: restart named
      service:
        name: bind9
        state: restarted

    - name: enable znc
      service:
        daemon_reload: True
        name: znc
        enabled: true
      notify:
        - restart znc

    - name: restart znc
      service:
        name: znc
        state: restarted

    - name: restart postfix
      systemd:
        name: postfix
        enabled: true
        state: restarted
      notify:
        - test mail

# vim: shiftwidth=2 tabstop=2 softtabstop=2 expandtab
