infra/ansible/roles/netbox/tasks/main.yml

---
# Bare-metal NetBox install (mirrors live netbox.vntx.net layout). Runs:
#   1. system packages
#   2. netbox user/group
#   3. PostgreSQL role + database
#   4. Redis (default config; just ensure running)
#   5. Fetch + extract release tarball into {{ netbox_install_dir }}
#   6. Run upgrade.sh (creates venv, installs deps, runs migrate + collectstatic)
#   7. Render configuration.py + gunicorn.py
#   8. Render systemd units (netbox + netbox-rq)
#   9. Render per-host Caddyfile (the caddy role's host-specific template hook)

- name: Assert required secrets are present
  ansible.builtin.assert:
    that:
      - netbox_secret_key is defined and netbox_secret_key | length >= 50
      - netbox_db_password is defined and netbox_db_password | length > 0
    fail_msg: >-
      netbox_secret_key (>= 50 chars) and netbox_db_password must be set in
      host_vars / ansible-vault before this role can run. See
      ansible/roles/netbox/README.md.

- name: Install system packages
  ansible.builtin.apt:
    name: "{{ netbox_system_packages }}"
    state: present
    update_cache: true

- name: Ensure PostgreSQL is started and enabled
  ansible.builtin.systemd:
    name: postgresql
    state: started
    enabled: true

- name: Ensure Redis is started and enabled
  ansible.builtin.systemd:
    name: redis-server
    state: started
    enabled: true

- name: Stop netbox services before user/group changes
  ansible.builtin.systemd:
    name: "{{ item }}"
    state: stopped
  loop:
    - netbox
    - netbox-rq
  failed_when: false

- name: Create netbox group
  ansible.builtin.group:
    name: "{{ netbox_group }}"
    system: true
    state: present

- name: Create netbox user
  ansible.builtin.user:
    name: "{{ netbox_user }}"
    group: "{{ netbox_group }}"
    system: true
    shell: /usr/sbin/nologin
    home: "{{ netbox_install_dir }}"
    create_home: false
    state: present

- name: Create PostgreSQL role
  community.postgresql.postgresql_user:
    name: "{{ netbox_db_user }}"
    password: "{{ netbox_db_password }}"
    state: present
  become: true
  become_user: postgres

- name: Create NetBox database
  community.postgresql.postgresql_db:
    name: "{{ netbox_db_name }}"
    owner: "{{ netbox_db_user }}"
    encoding: UTF-8
    state: present
  become: true
  become_user: postgres

- name: Check installed NetBox version
  ansible.builtin.slurp:
    src: "{{ netbox_install_dir }}/netbox/release.yaml"
  register: netbox_release_file
  failed_when: false
  changed_when: false

- name: Set installed-version fact
  ansible.builtin.set_fact:
    netbox_installed_version: >-
      {{
        (netbox_release_file.content | b64decode
          | regex_search('version:\s*"?([0-9.]+)"?', '\1')
          | first)
        if netbox_release_file is defined and netbox_release_file.content is defined
        else ''
      }}

- name: Decide whether NetBox needs (re)install
  ansible.builtin.set_fact:
    netbox_needs_install: "{{ netbox_installed_version != netbox_version }}"

- name: Download NetBox release tarball
  ansible.builtin.get_url:
    url: "{{ netbox_release_url }}"
    dest: "/tmp/netbox-{{ netbox_version }}.tar.gz"
    mode: "0644"
  when: netbox_needs_install

- name: Extract NetBox release into a versioned directory
  ansible.builtin.unarchive:
    src: "/tmp/netbox-{{ netbox_version }}.tar.gz"
    dest: /opt
    remote_src: true
    creates: "/opt/netbox-{{ netbox_version }}"
  when: netbox_needs_install

- name: Symlink {{ netbox_install_dir }} -> /opt/netbox-{{ netbox_version }}
  ansible.builtin.file:
    src: "/opt/netbox-{{ netbox_version }}"
    dest: "{{ netbox_install_dir }}"
    state: link
    force: true
  when: netbox_needs_install
  notify:
    - Restart netbox
    - Restart netbox-rq

- name: Ensure netbox owns mutable subdirs
  ansible.builtin.file:
    path: "{{ netbox_install_dir }}/netbox/{{ item }}"
    state: directory
    owner: "{{ netbox_user }}"
    group: "{{ netbox_group }}"
    mode: "0755"
  loop:
    - media
    - reports
    - scripts
    - static

- name: Render local_requirements.txt (plugin Python deps)
  ansible.builtin.copy:
    dest: "{{ netbox_install_dir }}/local_requirements.txt"
    content: "{{ netbox_local_requirements | join('\n') }}\n"
    owner: root
    group: root
    mode: "0644"
  notify:
    - Restart netbox
    - Restart netbox-rq

- name: Render configuration.py
  ansible.builtin.template:
    src: configuration.py.j2
    dest: "{{ netbox_install_dir }}/netbox/netbox/configuration.py"
    owner: root
    group: "{{ netbox_group }}"
    mode: "0640"
  notify:
    - Restart netbox
    - Restart netbox-rq

- name: Render gunicorn.py
  ansible.builtin.template:
    src: gunicorn.py.j2
    dest: "{{ netbox_install_dir }}/gunicorn.py"
    owner: "{{ netbox_user }}"
    group: "{{ netbox_group }}"
    mode: "0644"
  notify: Restart netbox

- name: Run NetBox upgrade.sh (creates venv, installs deps, migrates DB, collectstatic)
  ansible.builtin.command: "{{ netbox_install_dir }}/upgrade.sh"
  args:
    chdir: "{{ netbox_install_dir }}"
  register: netbox_upgrade
  when: netbox_needs_install
  changed_when: netbox_upgrade.rc == 0

- name: Render netbox systemd unit
  ansible.builtin.template:
    src: netbox.service.j2
    dest: /etc/systemd/system/netbox.service
    owner: root
    group: root
    mode: "0644"
  notify: Restart netbox

- name: Render netbox-rq systemd unit
  ansible.builtin.template:
    src: netbox-rq.service.j2
    dest: /etc/systemd/system/netbox-rq.service
    owner: root
    group: root
    mode: "0644"
  notify: Restart netbox-rq

- name: Enable and start NetBox services
  ansible.builtin.systemd:
    name: "{{ item }}"
    enabled: true
    state: started
    daemon_reload: true
  loop:
    - netbox
    - netbox-rq