site.yml

---
# All tasks are run as the deploy user, which can sudo when needed.

# DNS needs to be up first so that certbot can find us to issue a
# cert.  This probably means a two phase thing - common firewall and
# dns, wait for propogation, and then the rest.   
- hosts: cloud
  remote_user: "{{ deploy_acct }}"
  become: True
  force_handlers: True
  vars:
    ansible_ssh_common_args: '-o StrictHostKeyChecking=accept-new'
    ansible_ssh_private_key_file: "{{ deploy_acct_sshkey }}"
  roles:
    - { role: common, tags: common }
    - { role: cryptdir, tags: cryptdir }
    - { role: apache, tags: web }
    - { role: mailhost, tags: mail }
    - { role: bacula-client, tags: bacula-client }

# On the director machine we also need the client because we are doing
# a local backup of the catalog.
- hosts: backup_server
  remote_user: "{{ deploy_acct }}"
  become: True
  force_handlers: True
  vars:
    ansible_ssh_common_args: '-o StrictHostKeyChecking=accept-new'
    ansible_ssh_private_key_file: "{{ deploy_acct_sshkey }}"
  roles:
    - { role: common, tags: common }
    - { role: mailnull, tags: mail }
    - { role: cryptdir, tags: cryptdir }
    - { role: bacula-client, tags: bacula-client }
    - { role: bacula-director, tags: bacula-director }