playbook.yml

---
##############################################################################
### Bootstrap hosts with no Python interpreter installed
- name: "Install Python if needed"
  hosts: "all"
  become: True
  gather_facts: False
  tasks:
    - name: "Check for working Python interpreter"
      ping:
      register: pingresult
      ignore_errors: True
      changed_when: False
    - name: "Install Python on FreeBSD (this task is expected to fail on Debian)"
      raw: "test -f /etc/freebsd-update.conf && pkg install -y python"
      ignore_errors: True
      changed_when: False
      when: pingresult and not "ping" in pingresult
      register: freebsdresult
    - name: "Install Python on Debian"
      raw: "test -f /etc/debian_version && apt install -y python-is-python3"
      ignore_errors: True
      changed_when: False
      when:
        - pingresult and not "ping" in pingresult
        - not freebsdresult is changed


##############################################################################
### Include extra variables, first global, then group secrets, then host secrets
- name: "Include group secrets"
  hosts: "all"
  tasks:
    - name: "Check if group secrets exists in group_vars for any group this host is a member of"
      local_action: stat path="../group_vars/{{ item }}-secrets.yml"
      tags:
        - "always"
      loop: "{{ group_names }}"
      register: result
    - name: "Include group secrets when the file exists"
      include_vars: "{{ item.stat.path }}"
      tags:
        - "always"
      when: item.stat.exists
      loop: "{{ result.results }}"

- name: "Include host secrets"
  hosts: "all"
  tasks:
    - name: "Check if host secrets exists in host_vars"
      local_action: stat path="../host_vars/{{ ansible_nodename }}-secrets.yml"
      register: stat_result
      tags:
        - "always"
    - name: "Include host secrets when the file exists"
      include_vars: "../host_vars/{{ ansible_nodename }}-secrets.yml"
      tags:
        - "always"
      when: stat_result.stat.exists


##############################################################################
### set_facts needed by later roles
- name: "Register needed variables with set_facts"
  hosts: "all"
  tasks:
    - name: "Register network_interfaces (include network_interfaces_extra)"
      set_fact:
        network_interfaces: "{{ network_interfaces|default(network_interfaces_default) + network_interfaces_extra|default([]) }}"
      tags:
        - "always"
      when: network_interfaces is defined or ansible_default_ipv4.device is defined
    - name: "Register bird2_protocols (include bird2_protocols_extra)"
      set_fact:
        bird2_protocols: "{{ bird2_protocols|default([]) + bird2_protocols_extra|default([]) }}"
      tags:
        - "always"


##############################################################################
### base and host roles

- name: "configure basic stuff on all freebsd hosts"
  hosts: "all"
  become: True
  roles:
    - role: "freebsd_base"
      when: ansible_distribution == "FreeBSD"

- name: "configure basic stuff on all debian hosts"
  hosts: "all"
  become: True
  roles:
    - role: "debian_base"
      when: ansible_distribution == "Debian"

- name: "configure freebsd hosts (physical or virtual servers)"
  hosts: "freebsd_hosts"
  become: True
  roles:
    - "freebsd_host"

- name: "configure ezjail hosts"
  hosts: "ezjail_hosts"
  become: True
  roles:
    - "ezjail_host"

- name: "configure chyves bhyve hosts"
  hosts: "chyves_hosts"
  become: True
  roles:
    - "chyves_host"

- name: "configure vnet jail hosts"
  hosts: "jail_hosts"
  become: True
  roles:
    - "jail_host"

##############################################################################
### application roles below here

- name: "configure etherpad servers"
  hosts: "etherpad_servers"
  become: True
  roles:
    - "etherpad_server"

- name: "configure all murmur servers"
  hosts: "murmur_servers"
  become: True
  roles:
    - "murmur_server"

- name: "configure all nginx http and https servers"
  hosts: "nginx_servers"
  become: True
  roles:
    - "nginx_server"

- name: "configure dovecot servers"
  hosts: "dovecot_servers"
  become: True
  roles:
    - "dovecot_server"

- name: "configure erlang webservers"
  hosts: "erlang_web_servers"
  become: True
  roles:
    - "erlang_web_server"

- name: "configure wiki servers"
  hosts: "mediawiki_servers"
  become: True
  roles:
    - "mediawiki_server"

- name: "configure people servers"
  hosts: "people_servers"
  become: True
  roles:
    - "people_server"

- name: "configure postfix servers"
  hosts: "postfix_servers"
  become: True
  roles:
    - "postfix_server"

- name: "configure tor servers"
  hosts: "tor_servers"
  become: True
  roles:
    - "tor_server"

- name: "configure kea dhcp servers"
  hosts: "kea_servers"
  become: True
  roles:
    - "kea_server"

- name: "configure znc servers"
  hosts: "znc_servers"
  become: True
  roles:
    - "znc_server"

- name: "configure isc dhcp servers"
  hosts: "isc_dhcpd_servers"
  become: True
  roles:
    - "isc_dhcpd_server"

- name: "configure metabase servers"
  hosts: "metabase_servers"
  become: True
  roles:
    - "metabase_server"

- name: "configure PostgreSQL servers"
  hosts: "postgresql_servers"
  become: True
  roles:
    - "postgresql_server"

- name: "configure Unbound servers"
  hosts: "unbound_servers"
  become: True
  roles:
    - "unbound_server"

- name: "configure syslog-ng servers"
  hosts: "syslogng_servers"
  become: True
  roles:
    - "syslogng_server"

- name: "configure zabbix servers"
  hosts: "zabbix_servers"
  become: True
  roles:
    - "zabbix_server"

- name: "configure zabbix frontend servers"
  hosts: "zabbix_frontend_servers"
  become: True
  roles:
    - "zabbix_frontend_server"

- name: "configure zabbix proxy servers"
  hosts: "zabbix_proxy_servers"
  become: True
  roles:
    - "zabbix_proxy_server"

- name: "configure roundcube servers"
  hosts: "roundcube_servers"
  become: True
  roles:
    - "roundcube_server"

- name: "configure nfsen servers"
  hosts: "nfsen_servers"
  become: True
  roles:
    - "nfsen_server"

- name: "configure tykbackup servers"
  hosts: "tykbackup_servers"
  become: True
  roles:
    - "tykbackup_server"

- name: "configure download servers"
  hosts: "download_servers"
  become: True
  roles:
    - "download_server"

- name: "configure rt servers"
  hosts: "rt_servers"
  become: True
  roles:
    - "rt_server"

- name: "configure radicale servers"
  hosts: "radicale_servers"
  become: True
  roles:
    - "radicale_server"

- name: "configure elk servers"
  hosts: "elk_servers"
  become: True
  roles:
    - "elk_server"

- name: "configure iperf servers"
  hosts: "iperf_servers"
  become: True
  roles:
    - "iperf_server"

- name: "configure bind servers"
  hosts: "bind_servers"
  become: True
  roles:
    - "bind_server"

- name: "configure prometheus servers"
  hosts: "prometheus_servers"
  become: True
  roles:
    - "prometheus_server"

- name: "configure grafana servers"
  hosts: "grafana_servers"
  become: True
  roles:
    - "grafana_server"

- name: "configure ansible servers"
  hosts: "ansible_servers"
  become: True
  roles:
    - "ansible_server"

- name: "configure django channels2 servers"
  hosts: "django_channels2_servers"
  become: True
  roles:
    - "django_channels2_server"

- name: "configure nipapd servers"
  hosts: "nipapd_servers"
  become: True
  roles:
    - "nipapd_server"

- name: "configure nipapcli servers"
  hosts: "nipapcli_servers"
  become: True
  roles:
    - "nipapcli_server"

- name: "configure nipapwww servers"
  hosts: "nipapwww_servers"
  become: True
  roles:
    - "nipapwww_server"

- name: "configure speedtest servers"
  hosts: "speedtest_servers"
  become: True
  roles:
    - "speedtest_server"

- name: "configure mastodon servers"
  hosts: "mastodon_servers"
  become: True
  roles:
    - "mastodon_server"

- name: "configure freeradius3 servers"
  hosts: "freeradius_servers"
  become: True
  roles:
    - "freeradius_server"

- name: "configure alertmanager servers"
  hosts: "alertmanager_servers"
  become: True
  roles:
    - "alertmanager_server"

- name: "configure searx servers"
  hosts: "searx_servers"
  become: True
  roles:
    - "searx_server"

- name: "configure blackbox exporter servers"
  hosts: "blackbox_exporter_servers"
  become: True
  roles:
    - "blackbox_exporter_server"

- name: "configure nfs servers"
  hosts: "nfs_servers"
  become: True
  roles:
    - "nfs_server"

- name: "configure snmp_exporter servers"
  hosts: "snmp_exporter_servers"
  become: True
  roles:
    - "snmp_exporter_server"

- name: "configure poudriere servers"
  hosts: "poudriere_servers"
  become: True
  roles:
    - "poudriere_server"

- name: "configure prosody servers"
  hosts: "prosody_servers"
  become: True
  roles:
    - "prosody_server"

- name: "configure ctld servers"
  hosts: "ctld_servers"
  become: True
  roles:
    - "ctld_server"

- name: "configure gitea servers"
  hosts: "gitea_servers"
  become: True
  roles:
    - "gitea_server"

- name: "configure powerdns_recursor servers"
  hosts: "powerdns_recursor_servers"
  become: True
  roles:
    - "powerdns_recursor_server"

- name: "configure powerdns auth servers"
  hosts: "powerdns_auth_servers"
  become: True
  roles:
    - "powerdns_auth_server"

- name: "configure dnsdist servers"
  hosts: "dnsdist_servers"
  become: True
  roles:
    - "dnsdist_server"

- name: "configure atheme servers"
  hosts: "atheme_servers"
  become: True
  roles:
    - "atheme_server"

- name: "configure openbgpd servers"
  hosts: "openbgpd_servers"
  become: True
  roles:
    - "openbgpd_server"

- name: "configure oxidized servers"
  hosts: "oxidized_servers"
  become: True
  roles:
    - "oxidized_server"

- name: "configure stund servers"
  hosts: "stund_servers"
  become: True
  roles:
    - "stund_server"

- name: "configure certgrinderd servers"
  hosts: "certgrinderd_servers"
  become: True
  roles:
    - "certgrinderd_server"

- name: "configure jitsi-meet servers"
  hosts: "jitsi_meet_servers"
  become: True
  roles:
    - "jitsi_meet_server"

- name: "configure NUT servers"
  hosts: "nut_servers"
  become: True
  roles:
    - "nut_server"

- name: "configure motion servers"
  hosts: "motion_servers"
  become: True
  roles:
    - "motion_server"

- name: "configure bird2 servers"
  hosts: "bird2_servers"
  become: True
  roles:
    - "bird2_server"

- name: "configure flask servers"
  hosts: "flask_servers"
  become: True
  roles:
    - "flask_server"

- name: "configure stubby servers"
  hosts: "stubby_servers"
  become: True
  roles:
    - "stubby_server"

- name: "configure loki servers"
  hosts: "loki_servers"
  become: True
  roles:
    - "loki_server"

- name: "configure pf servers"
  hosts: "pf_servers"
  become: True
  roles:
    - "pf_host"

- name: "configure mosquitto servers"
  hosts: "mosquitto_servers"
  become: True
  roles:
    - "mosquitto_server"

- name: "configure dns exporter servers"
  hosts: "dns_exporter_servers"
  become: True
  roles:
    - "dns_exporter_server"

- name: "configure unifi8 servers"
  hosts: "unifi_servers"
  become: True
  roles:
    - "unifi_server"

- name: "configure dmarc exporter servers"
  hosts: "dmarc_exporter_servers"
  become: True
  roles:
    - "dmarc_exporter_server"

- name: "configure grist servers"
  hosts: "grist_servers"
  become: True
  roles:
    - "grist_server"