- name: skund
  hosts: skund.p.vstill.cz
  vars:
    ansible_fqdn: skund.p.vstill.cz
    mail_relay: gate.p.vstill.cz
    pam_use_kerberos: false
    postfix: true
    nft_extra: |
        # Samba (local nets only)
        ip saddr 192.168.0.0/21 tcp dport { 139, 445 } accept
        ip saddr 192.168.0.0/21 tcp dport { 137, 138 } accept
    backup_users:
      - name: skund

  tasks:
      - fail:
          msg: possibly wrong server?
        when: ansible_distribution != 'Debian'

      - import_role:
          name: common_deb

      - import_role:
          name: vstill_deb

      - name: "Setup fstab"
        mount:
          path: '{{item.path}}'
          src: '{{item.src}}'
          fstype: '{{item.fstype}}'
          opts: '{{item.opts|default("defaults")}}'
          dump: "0"
          passno: '{{item.passno|default("0")}}'
          state: '{{item.state|default("mounted")}}'
        with_items:
          - path: "/"
            src: /dev/vg.root/root-deb
            fstype: xfs
            opts: rw,relatime,inode64,noquota
            passno: 1
          - path: "/boot"
            src: "UUID=D1F6-5913"
            fstype: vfat
            opts: rw,relatime,fmask=0022,dmask=0022,codepage=437,iocharset=ascii,shortname=mixed,utf8,errors=remount-ro
            passno: 2
          - path: none
            src: /dev/vg.root/swap
            fstype: swap
            state: present

          - path: /data
            src: /dev/vg.data/data-new
            fstype: xfs
            opts: rw,relatime,inode64,noquota,noauto,x-systemd.automount
            passno: 2

          - path: /backup
            src: /dev/vg.data/backup
            fstype: ext4
            opts: rw,relatime,noauto,x-systemd.automount
            passno: 2

          - path: /mnt/data-krull
            src: /dev/vg.data/data-krull
            fstype: ext4
            opts: rw,relatime,noauto,x-systemd.automount
            passno: 2

      - apt:
          pkg:
            - grub-efi
            - gdisk
            - dpkg-dev
            - duperemove

      - apt:
          pkg:
            - linux-headers-amd64
            - linux-image-amd64
            - cryptsetup-bin

      - name: Integrity udev rule
        copy:
          content: |
            ENV{ID_PART_ENTRY_SCHEME}=="gpt", ENV{ID_PART_ENTRY_NAME}=="integrity?*", RUN+="/usr/sbin/integritysetup open $env{DEVNAME} $env{ID_PART_ENTRY_NAME} --integrity sha1"
          dest: /etc/udev/rules.d/99-integrity.rules

      - name: Initramfs modules
        lineinfile:
          regex: '^{{item}}$'
          line: '{{item}}'
          path: /etc/initramfs-tools/modules
        loop:
          - raid1
          - dm_integrity

      - name: Samba
        import_role:
          name: samba
        vars:
          shares:
            - name: "foto-preview"
              path: "/data/xstill/foto-preview"
              public: true
              writeable: false

            - name: "foto"
              path: "/data/xstill/foto"
              read: xstill

            - name: "public"
              path: "/data/public"
              public: true
              writeable: true

      - name: "Obtain root's SSH public key"
        user:
          name: root
          generate_ssh_key: true
          ssh_key_type: ed25519
        register: root_user

      - name: "Backups"
        block:
          - name: "Backup group"
            group:
              name: 'backup-remote'
              system: true
  
          - name: "Backup users"
            user:
              name: 'backup-{{item.name}}'
              system: true
              create_home: true
              move_home: true
              home: '/backup/{{item.name}}'
              group: 'backup-remote'
              shell: /bin/bash
            loop: "{{backup_users}}"


          - name: "Backup script"
            copy:
              src: "../backup-tar/backup.sh"
              dest: "/usr/sbin/backup-tar"
              mode: "u=rx,g=,o="

          - name: "Backup config"
            copy:
              content: |
                TARGET=backup-skund@127.0.0.1
                SOURCES="/home/xstill/sync /home/xstill/recepty /home/xstill/_config /home/xstill/notes /data/xstill/repo-t14"
                WORK_DIR=/root/backup-work
              dest: "/backup/skund/backup-tar.config"

          - name: "Authorized key for backup-skund"
            ansible.posix.authorized_key:
              key: "{{root_user.ssh_public_key}}"
              user: "backup-skund"

          - name: "Cron monitoring setup – jobs"
            cron:
              user: "root"
              name: "backup-tar"
              special_time: "daily"
              job: "/usr/sbin/backup-tar /backup/skund/backup-tar.config"
