infra/ansible/playbook.yml

---
- name: Apply common configuration to all nodes
  hosts: all
  become: true
  # become_method: sudo
  gather_facts: true
  remote_user: ansible
  roles:
    - base
  tags:
    - common

  tasks:
    - name: Set timezone
      community.general.timezone:
        name: "{{ timezone }}"

- name: Apply resolver config
  hosts: resolvers
  gather_facts: true
  roles:
    - { role: resolvers, become: true }

- name: Apply ns config
  hosts: ns
  gather_facts: true
  become: true
  roles:
    - role: ns

- name: Apply netbox config
  hosts: netbox
  gather_facts: true
  become: true
  roles:
    - role: caddy_ansible.caddy_ansible
      caddy_systemd_network_dependency: true
      caddy_setcap: true
      caddy_systemd_capabilities_enabled: true
      caddy_systemd_capabilities: "CAP_NET_BIND_SERVICE"
      caddy_config: |
        {{ netbox.domain }} {
            bind {{ netbox.bind_address }}
            log {
              level error
            }
            route /static* {
              uri strip_prefix /static
              root * /opt/netbox/netbox/static
              file_server
            }
            @notStatic not path /static*
            encode gzip zstd
            reverse_proxy @notStatic http://localhost:{{ netbox.port }} {
                header_up Host {http.request.host}
                header_up X-Real-IP {http.request.remote.host}
                header_up X-Forwarded-For {http.request.remote.host}
                header_up X-Forwarded-Port {http.request.port}
                header_up X-Forwarded-Proto {http.request.scheme}
            }
        }

- name: Apply firewall rules to netbox
  hosts: netbox
  become: true
  # remote_user: graham
  handlers:
    - import_tasks: playbook_handlers.yml

  tasks:
    - name: Permit traffic in default zone for http service
      ansible.posix.firewalld:
        zone: public
        service: http
        permanent: true
        state: enabled

    - name: Permit traffic in default zone for https service
      ansible.posix.firewalld:
        zone: public
        service: https
        permanent: true
        state: enabled
      notify:
        - Restart firewalld

- name: Tailscale
  hosts: tailscale_home
  become: true
  gather_facts: true
  vars:
    inject_facts_as_vars: false
  roles:
    - role: artis3n.tailscale
      vars:
        # Pull Tailscale auth key from environment variable
        tailscale_authkey: "{{ lookup('ansible.builtin.env', 'TAILSCALE_KEY') }}"
        tailscale_args: "--ssh --advertise-exit-node"
  pre_tasks:
    - name: Debug - Check Tailscale key (will be partially redacted)
      debug:
        msg: "Key exists and starts with: {{ lookup('ansible.builtin.env', 'TAILSCALE_KEY')[0:10] }}..."

- name: Install and configure Caddy
  hosts: caddy_servers
  become: true
  tags:
    - caddy
  roles:
    - caddy

- name: Configure PostgreSQL servers
  hosts: postgresql_servers
  become: true
  gather_facts: true
  tags:
    - postgresql
    - database
  
  pre_tasks:
    - name: Set hostname
      hostname:
        name: "{{ inventory_hostname }}"
    
    - name: Update /etc/hosts
      lineinfile:
        path: /etc/hosts
        regexp: '^127\.0\.1\.1'
        line: "127.0.1.1 {{ inventory_hostname }}"
        state: present
    
    - name: Update apt cache
      apt:
        update_cache: yes
        cache_valid_time: 3600
    
    - name: Install Python dependencies for Ansible
      apt:
        name:
          - python3-apt
          - python3-psycopg2
        state: present
  
  roles:
    - raid
    - postgresql

# Plays from general.yml
- name: Apply general configuration to all nodes
  hosts: all
  become: yes
  become_method: sudo
  roles:
    - general
  tags:
    - general

- name: SNMP clients
  hosts: snmp_clients
  become: yes
  become_method: sudo
  roles:
    - snmp_clients
  tags:
    - snmp

- name: Docker servers
  hosts: docker
  become: yes
  become_method: sudo
  tags: docker
  roles:
    - docker
  vars:
    gpg_fingerprint: "9DC858229FC7DD38854AE2D88D81803C0EBFCD88"

- name: Syncthing servers
  hosts: syncthing_servers
  become: yes
  become_method: sudo
  tags: syncthing
  roles:
    - syncthing

# - import_playbook: baseline/proxmox/main.yml
# - name: Tailscale Home
#   hosts: tailscale_home
#   roles:
#     - role: artis3n.tailscale
#       vars:
#         # Example pulling the API key from the env vars on the host running Ansible
#         tailscale_authkey: "{{ lookup('env', 'TAILSCALE_KEY') }}"
#         tailscale_args: "--ssh --advertise-exit-node --advertise-routes=10.0.16.0/22"