- name: bk2.v.vstill.cz
  hosts: bk2.v.vstill.cz
  vars:
    ansible_fqdn: bk2.v.vstill.cz
    postfix: true
    mail_relay: 192.168.2.52
    pam_use_kerberos: false
    nft_extra:
        # Samba (local nets only)

        ip saddr 192.168.0.0/21 tcp dport { 139, 445 } accept

        ip saddr 192.168.0.0/21 tcp dport { 137, 138 } accept

  tasks:
    - fail:
        msg: possibly wrong server?
      when: ansible_distribution != 'Debian'

    - import_role:
        name: common_deb

    - name: Additional static IPv4 setup
      template:
        src: dhcpcd-ipv4-static-hook
        dest: /lib/dhcpcd/dhcpcd-hooks/09-ipv4-static
      vars:
        static_ip: 192.168.2.51/24
        static_dev: enp2s0
      notify:
        - restart dhcpcd

    - import_role:
        name: vstill_deb

#    - name: "Setup fstab"
#      mount:
#        path: '{{item.path}}'
#        src: '{{item.src}}'
#        fstype: '{{item.fstype}}'
#        opts: '{{item.opts|default("defaults")}}'
#        dump: "0"
#        passno: '{{item.passno|default("0")}}'
#        state: '{{item.state|default("mounted")}}'
#      with_items:
#        - path: "/"
#          src: /dev/vg.root/root-deb
#          fstype: xfs
#          opts: rw,relatime,attr2,inode64,logbufs=8,logbsize=32k,noquota
#          passno: 1
#        - path: none
#          src: /dev/vg.root/swap
#          fstype: swap
#          state: present
#        - path: /data
#          src: /dev/vg.data/data
#          fstype: xfs
#          opts: rw,relatime,attr2,inode64,noquota,noauto,x-systemd.automount
#          passno: 2
#        - path: /mnt/data-krull
#          src: /dev/vg.data/data-krull
#          fstype: ext4
#          opts: rw,relatime,noauto,x-systemd.automount
#          passno: 2

    - apt:
        pkg:
          - grub-efi
          - dpkg-dev
          - duperemove

    - apt:
        pkg:
          - linux-headers-amd64
          - linux-image-amd64
          - cryptsetup-bin

    - name: Integrity udev rule
      copy:
        content: |
          ENV{ID_PART_ENTRY_SCHEME}=="gpt", ENV{ID_PART_ENTRY_NAME}=="integrity?*", RUN+="/usr/sbin/integritysetup open $env{DEVNAME} $env{ID_PART_ENTRY_NAME} --integrity sha1"
        dest: /etc/udev/rules.d/99-integrity.rules

    - name: Initramfs modules
      lineinfile:
        regex: '^{{item}}$'
        line: '{{item}}'
        path: /etc/initramfs-tools/modules
      loop:
        - raid1
        - raid456
        - dm_integrity

    - name: OpenVPN service config
      template:
        src: openvpn-vstill.conf.j2
        dest: '/etc/openvpn/client/{{ovpn_hostname | default(inventory_hostname)}}.conf'
      register: ovpn_config

    - name: OpenVPN service
      systemd:
        name: 'openvpn-client@{{ovpn_hostname | default(inventory_hostname)}}.service'
        enabled: true
        state: '{{"restarted" if ovpn_config.changed else "started"}}'

    - name: Samba
      import_role:
        name: samba
      vars:
        shares:
          - name: "public"
            path: "/data/public"
            public: true
            writeable: true
