linux.yaml

---
# Setup - Groups

# Main - Common
- hosts: all:!pfsense
  tasks:
    # Install packages
    - name: install common packages
      package:
        name: "{{ item.name }}"
        state: present
      with_items: "{{ common_packages }}"
      tags: packages

- hosts: raspberry_pi:&ubuntu
  tasks:
    # Install packages
    - name: install rasberry pi ubuntu packages
      package:
        name: "{{ item.name }}"
        state: present
      with_items: "{{ raspberry_pi_ubuntu_packages }}"
      tags: packages
    - name: remove default "ubuntu" user
      user:
        name: ubuntu
        remove: yes
        state: absent
    - name: remove default "ubuntu" group
      group:
        name: ubuntu
        state: absent

# Main - Standard Linux
- hosts: linux
  roles:
    # Install any available package updates
    - role: robertdebock.update
      vars:
        update_reboot: no
      tags:
        - updates
        - setup
    # Reboot if necessary
    - role: robertdebock.reboot
      tags:
        - updates
        - setup
    # Set up main user
    - role: exterrestris.ansible_users
      vars:
        users:
          - "{{ main_user }}"
      tags:
        - users
    # Install/configure ZSH
    - role: viasite-ansible.zsh
      vars:
        zsh_user: "{{ main_user.username }}"
      tags: zsh
    # Run ssh-agent automatically on login
    - role: ssh_agent
      vars:
        user: "{{ main_user.username }}"
        ssh_agent_source_files:
          - '.bashrc'
          - '.zshrc.local.pre-p10k'
        ssh_agent_keys:
          - ~/.ssh/id_ed25519
    # Configure firewall
    - role: weareinteractive.ufw
      vars:
        ufw_rules: "{{ common_ufw_rules }}"
      tags: firewall
  tasks:
    # Install ZSH Powerlevel10k config
    - name: copy p10k config
      copy:
        src: "p10k.zsh"
        dest: "/home/{{ main_user.username }}/.p10k.zsh"
        owner: "{{ main_user.username }}"
        group: "{{ main_user.username }}"
        mode: '0644'
      tags: zsh

# Main - Groups
- hosts: proxmox
  roles:
    # Remove Proxmox 'unregisted' nag
    - role: ironicbadger.ansible_role_proxmox_nag_removal
      tags: proxmox
    # Disable cluster services to prevent SSD wear
    - role: proxmox_host
      tags: proxmox
    # Install SSL certificate
    - role: exterrestris.proxmox_ssl
      tags: ssl
  tasks:
    - name: install additional packages
      package:
        name: "{{ item.name }}"
        state: present
      with_items: "{{ proxmox_additional_packages }}"
      tags: packages
      
- hosts: proxmox_vm:&linux
  roles:
    # Install qemu-guest-agent
    - role: proxmox_vm

- hosts: zfs
  roles:
    # Install/configure ZFS pools
    - role: mrlesmithjr.zfs
      tags:
        - disks
        - zfs
    # Install/configure ZFS snapshots/replication using Sanoid
    - role: exterrestris.sanoid
      tags:
        - sanoid
        - zfs
  tasks:
    - name: install additional packages
      package:
        name: "{{ item.name }}"
        state: present
      with_items: "{{ zfs_additional_packages }}"
      tags: packages

- hosts: nas
  roles:
    # Set up groups needed for file permissions
    - role: exterrestris.ansible_users
      vars:
        users: "{{ nas_additional_users }}"
        groups_to_create: "{{ nas_common_groups + nas_additional_groups }}"
      tags:
        - users
    # Mount ext4 disks
    - role: mount_disks
    # Install/configure mergerfs
    - role: tigattack.mergerfs
      tags:
        - disks
        - mergerfs
  tasks:
    # Add main user to groups created
    - name: additional groups for main user
      user:
        name: "{{ main_user.username }}"
        groups: "{{ nas_common_groups | map(attribute='name') }}"
        append: yes
      tags:
        - users
    # Install packages
    - name: install common nas packages
      package:
        name: "{{ item.name }}"
        state: present
      with_items: "{{ nas_common_packages }}"
      tags: packages

- hosts: traefik:!docker
  roles:
    # Install Traefik
    - role: exterrestris.traefik
    # Configure firewall
    - role: weareinteractive.ufw
      vars:
        ufw_rules:
          - "{{ traefik_ufw_rules }}"
      tags:
        - firewall
        - traefik-firewall
    # Install SSL certificate
    - role: exterrestris.fetch_ssl
      tags:
        - traefik-ssl
        - ssl
  tags:
    - traefik

- hosts: docker:!raspberry_pi
  roles:
    # Install Docker (x64)
    - role: geerlingguy.docker
      when: "'raspberry_pi' not in group_names"
    # Install Docker/Docker Compose PIP packages (needed for Ansible to control Docker)
    # - role: geerlingguy.pip
    #   vars:
    #     pip_install_packages:
    #       - name: docker
    #       - name: docker-compose
  tags:
    - docker
    - docker-install

- hosts: docker:&raspberry_pi
  roles:
    # # Install PIP
    # - role: geerlingguy.pip
    #   vars:
    #     pip_install_packages:
    #       - name: docker
    #         # geerlingguy.docker_arm will install docker-compose pip package
    # Install Docker (arm)
    - role: geerlingguy.docker_arm
      when: "'raspberry_pi' in group_names"
  tags: docker-install

- hosts: docker
  roles:
    # Set up users specific to containers
    - role: exterrestris.ansible_users
      vars:
        users: "{{ container_users | map('combine', container_user_opts) }}"
      tags:
        - container-users
    # Install Traefik
    - role: exterrestris.traefik
      tags:
        - traefik
      when: "'traefik' in group_names"
    # Configure firewall
    - role: weareinteractive.ufw
      vars:
        ufw_rules:
          - "{{ traefik_ufw_rules }}"
          - "{{ docker_ufw_rules }}"
      tags:
        - firewall
        - docker-firewall
    # Install SSL certificate
    - role: exterrestris.fetch_ssl
      tags:
        - traefik
        - traefik-ssl
        - ssl
      when: "'traefik' in group_names"
    # Generate Docker Compose
    - role: exterrestris.docker_compose
      tags:
        - docker-compose
    - role: linuxserver_containers
      tags:
        - docker-compose
  tags:
    - docker

- hosts: nas
  roles:
    # Install/configure Samba shares/users
    - role: vladgh.samba.server
      tags:
        - samba
    # Configure firewall
    - role: weareinteractive.ufw
      vars:
        ufw_rules: "{{ nas_ufw_rules }}"
      tags: firewall
    # Set up WSDD for network discovery
    - role: exterrestris.wsdd
      tags:
        - wsdd
        - samba

# Main - Host Specific
- hosts: memory_alpha
  tasks:
    # Add 'Scans' role to main user
    - name: additional groups for main user
      user:
        name: "{{ main_user.username }}"
        groups: "{{ scans_user.group }}"
        append: yes
      tags:
        - users