main.yml

---
- name: Installing OS to the Magisystem
  hosts: hetzner
  gather_facts: false
  pre_tasks:
    # Check for connection, skip the play if the OS is already installed
    # (and thus the server is accessible through custom port and username)
    - name: Checking connection
      ansible.builtin.wait_for_connection:
        timeout: 10
      register: hetzner_connected
      ignore_errors: true

    - name: Skip play if OS is already installed
      ansible.builtin.meta: end_host
      when: hetzner_connected is not failed

    - name: Setting default ssh port and username
      ansible.builtin.set_fact:
        ansible_port: 22
        ansible_user: root
  roles:
    - role: hetzner/install
  tasks:
    - name: Remove host from Controller's known hosts
      delegate_to: localhost
      connection: local
      ansible.builtin.known_hosts:
        name: '{{ ansible_host }}'
        state: absent
    - name: Restoring port and username
      ansible.builtin.set_fact:
        ansible_port: '{{ hetzner_install_ansible_port }}'
        ansible_user: '{{ hetzner_install_ansible_user }}'
    - name: Waiting for server to come back up online after reboot
      ansible.builtin.wait_for_connection: {}
    - name: Run post-install
      ansible.builtin.import_role:
        name: hetzner/install
        defaults_from: post-install
        tasks_from: post-install

- name: Managing containers on the Magisystem
  hosts: magisystem
  vars:
    mail_server:
      # SMTP Host Emails are sent to
      host: '{{ mail_server_settings["host"] | default("") | trim }}'
      port: '{{ mail_server_settings["port"] | default("587") | int | string }}'
      # Optionally authenticate (don't add quotation marks to you password)
      username: '{{ mail_server_settings["username"] | trim | default("") }}'
      password: '{{ mail_server_settings["password"] | default("") }}'
      # Use StartTLS
      use_tls: '{{ mail_server_settings["use_tls"] | default("false") | bool | string }}'
      # Use SSL
      use_ssl: '{{ mail_server_settings["use_ssl"] | default("false") | bool | string }}'
      timeout: '{{ mail_server_settings["timeout"] | default("30") | int | string }}'
  roles:
    - role: edge/setup
    - role: edge/watchtower
      tags:
        - watchtower
        - updates
    - role: edge/wireguard-services
      tags:
        - wireguard-services
        - vpn
        - vpn-services
    - role: edge/traefik
      tags:
        - reverse-proxy
        - traefik
    - role: edge/authentik
      tags:
        - auth
        - authentik
    - role: edge/rss-bridge
      tags:
        - rss
    - role: edge/bitwarden
      tags:
        - password
        - bitwarden
        - vaultwarden
      when: authentik_ldap_token is defined
    - role: edge/nextcloud
      tags:
        - cloud
        - nextcloud
    - role: edge/grocy
      tags:
        - grocy
  handlers:
    - &firewalld-handler
      name: Add internal networks in firewalld
      ansible.builtin.include_tasks: roles/edge/fix-docker-internal-firewalld/tasks/main.yml

- name: Managing containers on Ayanami
  hosts: ayanami
  roles:
    - role: ayanami/setup
    - role: edge/setup
    - role: edge/watchtower
      tags:
        - watchtower
        - updates
    - role: edge/traefik
      tags:
        - reverse-proxy
        - traefik
    - role: edge/authentik
      tags:
        - auth
        - authentik
    - role: edge/navidrome
      tags:
        - navidrome
        - music
      vars:
        navidrome_music_folder: '{{ (storage_pool_folder, "music") | path_join }}'
        navidrome_music_ingest_folder: '{{ (storage_pool_folder, "music-ingest") | path_join }}'
  handlers:
    - *firewalld-handler

- name: Configuring DNS for Migadu
  hosts: localhost
  tasks:
    - name: Creating DNS Records
      ansible.builtin.include_role:
        name: hetzner/dns
        tasks_from: migadu-mail
        defaults_from: migadu-mail
  tags:
    - mail