infra/ansible/playbook.yml

---
- name: Apply common configuration to all nodes
  hosts: all
  become: true
  # become_method: sudo
  gather_facts: true
  remote_user: ansible
  roles:
    - base
  tags:
    - common

  tasks:
    - name: Set timezone
      community.general.timezone:
        name: "{{ timezone }}"

- name: Apply resolver config
  hosts: resolvers
  gather_facts: true
  roles:
    - { role: resolvers, become: true }

- name: Apply ns config
  hosts: ns
  gather_facts: true
  become: true
  roles:
    - role: ns

- name: Apply netbox config
  hosts: netbox
  gather_facts: true
  become: true
  roles:
    - role: caddy_ansible.caddy_ansible
      caddy_systemd_network_dependency: true
      caddy_setcap: true
      caddy_systemd_capabilities_enabled: true
      caddy_systemd_capabilities: "CAP_NET_BIND_SERVICE"
      caddy_config: |
        {{ netbox.domain }} {
            bind {{ netbox.bind_address }}
            log {
              level error
            }
            route /static* {
              uri strip_prefix /static
              root * /opt/netbox/netbox/static
              file_server
            }
            @notStatic not path /static*
            encode gzip zstd
            reverse_proxy @notStatic http://localhost:{{ netbox.port }} {
                header_up Host {http.request.host}
                header_up X-Real-IP {http.request.remote.host}
                header_up X-Forwarded-For {http.request.remote.host}
                header_up X-Forwarded-Port {http.request.port}
                header_up X-Forwarded-Proto {http.request.scheme}
            }
        }

- name: Apply firewall rules to netbox
  hosts: netbox
  become: true
  # remote_user: graham
  handlers:
    - import_tasks: playbook_handlers.yml

  tasks:
    - name: Permit traffic in default zone for http service
      ansible.posix.firewalld:
        zone: public
        service: http
        permanent: true
        state: enabled

    - name: Permit traffic in default zone for https service
      ansible.posix.firewalld:
        zone: public
        service: https
        permanent: true
        state: enabled
      notify:
        - Restart firewalld

- name: Tailscale
  hosts: tailscale_home
  become: true
  gather_facts: true
  vars:
    inject_facts_as_vars: false
  roles:
    - role: artis3n.tailscale
      vars:
        # Pull Tailscale auth key from environment variable
        tailscale_authkey: "{{ lookup('ansible.builtin.env', 'TAILSCALE_KEY') }}"
        tailscale_args: "--ssh --advertise-exit-node"
  pre_tasks:
    - name: Debug - Check Tailscale key (will be partially redacted)
      debug:
        msg: "Key exists and starts with: {{ lookup('ansible.builtin.env', 'TAILSCALE_KEY')[0:10] }}..."

- name: Install and configure Caddy
  hosts: caddy_servers
  become: true
  tags:
    - caddy
  roles:
    - caddy

- name: Configure PostgreSQL servers
  hosts: postgresql_servers
  become: true
  gather_facts: true
  tags:
    - postgresql
    - database
  
  pre_tasks:
    - name: Set hostname
      hostname:
        name: "{{ inventory_hostname }}"
    
    - name: Update /etc/hosts
      lineinfile:
        path: /etc/hosts
        regexp: '^127\.0\.1\.1'
        line: "127.0.1.1 {{ inventory_hostname }}"
        state: present
    
    - name: Update apt cache
      apt:
        update_cache: yes
        cache_valid_time: 3600
    
    - name: Install Python dependencies for Ansible
      apt:
        name:
          - python3-apt
          - python3-psycopg2
        state: present
  
  roles:
    - raid
    - postgresql

- name: Provision BIND9 VM on Proxmox
  hosts: localhost
  gather_facts: false
  tags:
    - dns
    - bind9
    - provision
  vars:
    # Proxmox connection settings (matches terraform/variables.tf)
    proxmox_node: "{{ lookup('env', 'PROXMOX_NODE') | default('vm2-380', true) }}"
    proxmox_api_host: 10.0.0.2
    proxmox_api_user: "{{ lookup('env', 'PROXMOX_API_USER') | default('root@pam', true) }}"
    proxmox_api_password: "{{ lookup('env', 'PROXMOX_API_PASSWORD') }}"
    proxmox_storage: local-lvm
    proxmox_template_name: debian-cloud-init
    proxmox_template_vmid: 9000

    # BIND9 VM configuration
    vm_name: ns1.as393837.net
    vm_vmid: 222
    vm_ip: 204.110.191.222
    vm_gateway: 204.110.191.254
    vm_netmask: 255.255.255.224
    vm_cores: 2
    vm_memory: 2048
    vm_disk_size: 64
    ansible_ssh_key: "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFghGMnDdkfNC6JPEhMxrKhYDmNcXjHXp/y/mf3uLtzb"

  tasks:
    - name: Clone cloud-init template for BIND9 server
      community.proxmox.proxmox_kvm:
        node: "{{ proxmox_node }}"
        vmid: "{{ proxmox_template_vmid }}"
        clone: "{{ proxmox_template_name }}"
        newid: "{{ vm_vmid }}"
        name: "{{ vm_name }}"
        api_user: "{{ proxmox_api_user }}"
        api_password: "{{ proxmox_api_password }}"
        api_host: "{{ proxmox_api_host }}"
        storage: "{{ proxmox_storage }}"
        timeout: 90
        full: true

    - name: Configure VM resources
      community.proxmox.proxmox_kvm:
        node: "{{ proxmox_node }}"
        vmid: "{{ vm_vmid }}"
        name: "{{ vm_name }}"
        api_user: "{{ proxmox_api_user }}"
        api_password: "{{ proxmox_api_password }}"
        api_host: "{{ proxmox_api_host }}"
        cores: "{{ vm_cores }}"
        memory: "{{ vm_memory }}"
        update: true

    - name: Resize disk
      community.proxmox.proxmox_disk:
        vmid: "{{ vm_vmid }}"
        api_user: "{{ proxmox_api_user }}"
        api_password: "{{ proxmox_api_password }}"
        api_host: "{{ proxmox_api_host }}"
        disk: scsi0
        size: "{{ vm_disk_size }}G"
        state: resized

    - name: Configure cloud-init network
      community.proxmox.proxmox_kvm:
        node: "{{ proxmox_node }}"
        vmid: "{{ vm_vmid }}"
        name: "{{ vm_name }}"
        api_user: "{{ proxmox_api_user }}"
        api_password: "{{ proxmox_api_password }}"
        api_host: "{{ proxmox_api_host }}"
        ipconfig:
          ipconfig0: "ip={{ vm_ip }}/26,gw={{ vm_gateway }}"
        nameservers:
          - 1.1.1.1
          - 8.8.8.8
        ciuser: debian
        cipassword: "sxcbctolxALGnj2R8GStXrfW8GVd3s/ju91fNon7T1U="
        update: true

    - name: Start VM
      community.proxmox.proxmox_kvm:
        node: "{{ proxmox_node }}"
        vmid: "{{ vm_vmid }}"
        name: "{{ vm_name }}"
        api_user: "{{ proxmox_api_user }}"
        api_password: "{{ proxmox_api_password }}"
        api_host: "{{ proxmox_api_host }}"
        state: started

    - name: Wait for VM to be accessible via SSH
      wait_for:
        host: "{{ vm_ip }}"
        port: 22
        delay: 30
        timeout: 300
        state: started

    - name: Add VM to in-memory inventory
      add_host:
        name: "{{ vm_name }}"
        ansible_host: "{{ vm_ip }}"
        groups: bind9_servers

- name: Configure BIND9 Servers
  hosts: bind9_servers
  become: yes
  gather_facts: true
  tags:
    - dns
    - bind9
  roles:
    - role: base
      tags: base
    - role: ns
      tags: ns

# Plays from general.yml
- name: Apply general configuration to all nodes
  hosts: all
  become: yes
  become_method: sudo
  roles:
    - general
  tags:
    - general

- name: Syncthing servers
  hosts: syncthing_servers
  become: yes
  become_method: sudo
  tags: syncthing
  roles:
    - syncthing