full.yml

---

- name: Initial tasks
  hosts: all
  become: true
  gather_facts: false
  tasks:
    - name: Create data directory
      file:
        path: "{{ data_path }}"
        state: directory
        owner: "{{ user_uid_1000 }}"
        group: "{{ group_gid_1000 }}"
        mode: 0700
    - name: Add domain to /etc/hosts
      lineinfile:
        path: /etc/hosts
        regexp: '^127.0.0.1'
        line: "127.0.0.1       localhost {{ base_domain }}"
        insertbefore: BOF
        state: present
  tags:
    - init
    - test

- name: Deploy common
  hosts: all
  become: true
  gather_facts: false
  pre_tasks:
    - name: Gather facts
      setup:
        filter: ansible_*
  roles:
    - role: anarres_common
  tags:
    - common
    - test

- name: Deploy sec
  hosts: all
  become: true
  gather_facts: false
  roles:
    - role: anarres_sec
  tags:
    - sec
    - test

- name: Deploy web related services
  hosts: all
  become: true
  gather_facts: false
  vars:
    domain: "{{ base_domain }}"
    letsencrypt_renew_hook: /usr/sbin/service nginx reload
    letsencrypt_method: standalone
  pre_tasks:
    - name: Gather facts
      setup:
        filter: ansible_*

    - name: Add group name ssl-cert for SSL certificates
      group:
        name: ssl-cert
        state: present

    - name: Install certbot package
      package:
        name: certbot
        state: present
      retries: 3
      delay: 3
      register: install_certbot
      until: install_certbot is succeeded
      tags: letsencrypt

    - name: Create live directory for Let's Encrypt
      file:
        state: directory
        path: "/etc/letsencrypt/live"
        group: ssl-cert
        owner: root
      tags: letsencrypt

    - name: Create web directory
      file:
        path: "{{ web_path_letsencrypt }}"
        state: directory
        owner: www-data
        group: www-data
        mode: "u=rwx,g=r,o="
    - name: Add iptables rules for web HTTP
      iptables:
        chain: INPUT
        protocol: tcp
        ctstate: NEW
        match: tcp
        destination_port: "{{ web_ports_http | default('80') }}"
        jump: ACCEPT
        # comment: web HTTP
    - name: Add iptables rules for web HTTPS
      iptables:
        chain: INPUT
        protocol: tcp
        ctstate: NEW
        match: tcp
        destination_port: "{{ web_ports_https | default('443') }}"
        jump: ACCEPT
        # comment: web HTTPS
      notify: save iptables
      tags: iptables
  handlers:
    - name: save iptables
      command: netfilter-persistent save
  roles:
    - role: letsencrypt_request
      tags:
        - base_cert
        - letsencrypt_request
        - letsencrypt
    - role: anarres_nginx
      tags: nginx
  tags:
    - web-base
    - web
    - test

## Registry

- name: Deploy registry in docker
  hosts: all
  become: true
  gather_facts: false
  vars:
    create_volume: false
    service_name: registry
    docker_image: "{{ registry_docker_image }}"
    enable_db: false
    docker_command: |
      /usr/bin/docker run --rm --name "{{ service_name }}" \
      --user 1000:1000 \
      -v {{ registry_directory.data }}:/var/lib/registry \
      -v '/etc/localtime:/etc/localtime:ro' \
      -p {{ registry_internal_web_port }}:5000 \
      {{ docker_image }}
  pre_tasks:
    - name: Create registry directories
      file:
        path: "{{ item.value }}"
        state: directory
        owner: "{{ user_uid_1000 }}"
        group: "{{ group_gid_1000 }}"
        mode: 0700
      with_dict: "{{ registry_directory }}"
  roles:
    - role: generic_docker_systemd
  tags:
    - never
    - registry
    - test

- name: Get registry subdomain Let's Encrypt certificate
  hosts: all
  become: true
  gather_facts: false
  vars:
    domain: "{{ registry_domain }}"
    letsencrypt_renew_hook: /usr/sbin/service nginx reload
  roles:
    - role: letsencrypt_request
      tags: letsecrypt_request
  tags:
    - never
    - registry
    - test

- name: Configure nginx proxy for registry
  hosts: all
  become: true
  gather_facts: false
  vars:
    domain: "{{ registry_domain }}"
    binded_port: "{{ registry_internal_web_port }}"
    external_port: 443
    ssl_certificate: "/etc/letsencrypt/live/{{ domain }}/fullchain.pem"
    ssl_certificate_key: "/etc/letsencrypt/live/{{ domain }}/privkey.pem"
    template_path: registry_nginx.conf.j2
  pre_tasks:
    - name: Install passlib via pip
      pip:
        name: passlib
    - name: Insert htpasswd for Nginx basic auth
      htpasswd:
        path: /etc/nginx/conf.d/nginx.htpasswd
        name: "{{ registry_user }}"
        password: "{{ registry_pass }}"
        owner: root
        group: www-data
        mode: 0640
  roles:
    - role: add_nginx_proxy_conf
      tags: proxy
  tags:
    - never
    - registry
    - test

## CoreOS Clair

- name: Deploy clair in docker
  hosts: all
  become: true
  gather_facts: false
  vars:
    service_name: clair
    docker_image: "{{ clair_docker_image }}"
    docker_db_image: "{{ clair_db_image }}"
    create_network: true
    service_db_name: "{{ clair_db_service_name }}"
    db_type: postgres
    docker_service_directory_db: "{{ clair_directory.db }}"
    db_user_pass: "{{ clair_db_user_pass }}"
    db_config_port: 5432
    db_name: "{{ clair_db_name }}"
    db_user: "{{ clair_db_user }}"
    docker_command: |
      /usr/bin/docker run --rm --name "{{ service_name }}" \
      --user 1000:1000 \
      -p {{ clair_internal_ports }}:6060-6061 \
      -v {{ clair_directory.conf }}:/config \
      -v '/etc/localtime:/etc/localtime:ro' \
      --network "{{ service_name }}" \
      {{ docker_image }} -config=/config/config.yaml
  pre_tasks:
    - name: Create clair directories
      file:
        path: "{{ item.value }}"
        state: directory
        mode: 0700
        owner: "{{ user_uid_1000 }}"
        group: "{{ group_gid_1000 }}"
      with_dict: "{{ clair_directory }}"
    - name: Configure clair
      template:
        src: clair_config.yaml.j2
        dest: "{{ clair_directory.conf }}/config.yaml"
        force: "{{ override | default('no') }}"
        owner: "{{ user_uid_1000 }}"
        group: "{{ group_gid_1000 }}"
        mode: 0600
  roles:
    - role: generic_docker_systemd
  tags:
    - never
    - clair
    - test

## Registry web interface

- name: Deploy registry_web_interface in docker
  hosts: all
  become: true
  gather_facts: false
  vars:
    create_volume: false
    service_name: registry_web_interface
    docker_image: "{{ registry_web_interface_docker_image }}"
    enable_db: false
    docker_command: |
      /usr/bin/docker run --rm --name "{{ service_name }}" \
      -p {{ registry_web_interface_internal_web_port }}:8080 \
      -v '/etc/localtime:/etc/localtime:ro' \
      {% if registry_web_interface_enable_clair %}
      --network clair \
      {% endif %}
      {{ docker_image }} server \
      {% if registry_web_interface_enable_clair %}
      --clair http://clair:6060 \
      {% endif %}
      --registry {{ registry_web_interface_registry_url }} \
      --username {{ registry_web_interface_registry_user }} \
      --password {{ registry_web_interface_registry_pass }}
  roles:
    - role: generic_docker_systemd
  tags:
    - never
    - registry_web_interface
    - test

- name: Get registry_web_interface subdomain Let's Encrypt certificate
  hosts: all
  become: true
  gather_facts: false
  vars:
    domain: "{{ registry_web_interface_domain }}"
    letsencrypt_renew_hook: /usr/sbin/service nginx reload
  roles:
    - role: letsencrypt_request
      tags: letsecrypt_request
  tags:
    - never
    - registry_web_interface
    - test

- name: Configure nginx proxy for registry_web_interface
  hosts: all
  become: true
  gather_facts: false
  vars:
    domain: "{{ registry_web_interface_domain }}"
    binded_port: "{{ registry_web_interface_internal_web_port }}"
  roles:
    - role: add_nginx_proxy_conf
      tags: proxy
  tags:
    - never
    - registry_web_interface
    - test

## OpenLDAP

- name: Get openldap subdomain Let's Encrypt certificate
  hosts: all
  become: true
  gather_facts: false
  vars:
    domain: "{{ openldap_domain }}"
    letsencrypt_renew_hook: /usr/sbin/service docker.openldap restart
  roles:
    - role: letsencrypt_request
      tags: letsecrypt_request
  tags:
    - never
    - openldap
    - test

- name: Deploy openldap in docker
  hosts: all
  become: true
  gather_facts: false
  vars:
    create_volume: false
    enable_db: false
    create_network: true
    service_name: openldap
    docker_image: "{{ openldap_docker_image }}"
    container_certs_path: /container/service/slapd/assets/certs
    docker_command: |
      /usr/bin/docker run --rm --name "{{ service_name }}" \
      -v {{ openldap_directory.data }}:/var/lib/ldap \
      -v {{ openldap_directory.conf }}:/etc/ldap/slapd.d \
      -v /etc/letsencrypt/live/{{ openldap_domain }}:{{ container_certs_path }}/live/{{ openldap_domain }}/:ro \
      -v /etc/letsencrypt/archive/{{ openldap_domain }}:{{ container_certs_path }}/archive/{{ openldap_domain }}/:ro \
      -v '/etc/localtime:/etc/localtime:ro' \
      -p {{ openldap_port_secure }}:636 \
      -e LDAP_ORGANISATION="{{ openldap_domain }}" \
      -e LDAP_DOMAIN="{{ openldap_domain }}" \
      -e LDAP_ADMIN_PASSWORD="{{ openldap_admin_password }}" \
      -e LDAP_BASE_dn="{{ openldap_base_dn }}" \
      -e LDAP_READONLY_USER=true \
      -e LDAP_READONLY_USER_USERNAME=readonly \
      -e LDAP_READONLY_USER_PASSWORD="{{ openldap_readonly_password }}" \
      -e LDAP_TLS="true" \
      -e LDAP_TLS_VERIFY_CLIENT="try" \
      -e LDAP_TLS_CRT_FILENAME="live/{{ openldap_domain }}/cert.pem" \
      -e LDAP_TLS_KEY_FILENAME="live/{{ openldap_domain }}/privkey.pem" \
      -e LDAP_TLS_CA_CRT_FILENAME="live/{{ openldap_domain }}/fullchain.pem" \
      -e LDAP_NOFILE=1024 \
      --network {{ service_name }} \
      {{ docker_image }} --copy-service
  pre_tasks:
    - name: Create openldap directories
      file:
        path: "{{ item.value }}"
        state: directory
        mode: 0700
      with_dict: "{{ openldap_directory }}"
  post_tasks:
    - name: Add iptables rules for OpenLDAP
      become: true
      iptables:
        chain: INPUT
        protocol: tcp
        ctstate: NEW
        match: tcp
        destination_port: "{{ openldap_port_secure }}"
        jump: ACCEPT
        # comment: OpenLDAP
      notify: save iptables
      tags: iptables

    - name: Install requiered python LDAP module
      package:
        name: python3-ldap
        state: present
      tags: dependencies

    - name: Wait for configuration database container to start
      wait_for:
        port: "{{ openldap_port_secure }}"

    - name: Add groups organizational unit
      ldap_entry:
        dn: "ou=groups,{{ openldap_base_dn }}"
        objectClass: organizationalUnit
        server_uri: "{{ openldap_server_uri }}"
        start_tls: false
        validate_certs: "{{ testing is undefined and openldap_validate_certs }}"
        bind_dn: "cn=admin,{{ openldap_base_dn }}"
        bind_pw: "{{ openldap_admin_password }}"
      tags:
        - ldap-setup

    - name: Add users organizational unit
      ldap_entry:
        dn: "ou=users,{{ openldap_base_dn }}"
        objectClass: organizationalUnit
        server_uri: "{{ openldap_server_uri }}"
        start_tls: false
        validate_certs: "{{ testing is undefined and openldap_validate_certs }}"
        bind_dn: "cn=admin,{{ openldap_base_dn }}"
        bind_pw: "{{ openldap_admin_password }}"
      tags:
        - ldap-setup

    - name: Add users group
      ldap_entry:
        dn: "cn=users,ou=groups,{{ openldap_base_dn }}"
        objectClass: posixGroup
        attributes:
          gidNumber: 2000
        server_uri: "{{ openldap_server_uri }}"
        start_tls: false
        validate_certs: "{{ testing is undefined and openldap_validate_certs }}"
        bind_dn: "cn=admin,{{ openldap_base_dn }}"
        bind_pw: "{{ openldap_admin_password }}"
      tags:
        - ldap-setup
  handlers:
    - name: save iptables
      command: netfilter-persistent save
  roles:
    - role: generic_docker_systemd
  tags:
    - never
    - openldap
    - test

## phpLDAPadmin

- name: Deploy phpldapadmin in docker
  hosts: all
  become: true
  gather_facts: false
  vars:
    create_volume: false
    enable_db: false
    service_name: phpldapadmin
    docker_image: "{{ phpldapadmin_docker_image }}"
    docker_command: |
      /usr/bin/docker run --rm --name "{{ service_name }}" \
      -p {{ phpldapadmin_internal_web_port }}:80 \
      -e  PHPLDAPADMIN_LDAP_HOSTS="{{ phpldapadmin_ldap_hosts }}" \
      -e PHPLDAPADMIN_HTTPS="false" \
      -e PHPLDAPADMIN_LDAP_CLIENT_TLS_REQCERT="allow" \
      -v '/etc/localtime:/etc/localtime:ro' \
      --network openldap \
      {{ docker_image }}
  roles:
    - role: generic_docker_systemd
  tags:
    - never
    - phpldapadmin
    - test

- name: Get phpldapadmin subdomain Let's Encrypt certificate
  hosts: all
  become: true
  gather_facts: false
  vars:
    domain: "{{ phpldapadmin_domain }}"
    letsencrypt_renew_hook: /usr/sbin/service nginx reload
  roles:
    - role: letsencrypt_request
      tags: letsecrypt_request
  tags:
    - never
    - phpldapadmin
    - test

- name: Configure nginx proxy for phpldapadmin
  hosts: all
  become: true
  gather_facts: false
  vars:
    domain: "{{ phpldapadmin_domain }}"
    binded_port: "{{ phpldapadmin_internal_web_port }}"
  roles:
    - role: add_nginx_proxy_conf
      tags: proxy
  tags:
    - never
    - phpldapadmin
    - test

## Prosody

- name: Get prosody subdomain Let's Encrypt certificate
  hosts: all
  become: true
  gather_facts: false
  vars:
    domain: "{{ prosody_domain }}"
    letsencrypt_renew_hook: /usr/sbin/service docker.prosody restart
  roles:
    - role: letsencrypt_request
      tags: letsecrypt_request
  tags:
    - never
    - prosody
    - test

- name: Get prosody subdomain Let's Encrypt certificate for MUC
  hosts: all
  become: true
  gather_facts: false
  vars:
    domain: "{{ prosody_domain_muc }}"
    letsencrypt_renew_hook: /usr/sbin/service docker.prosody restart
  roles:
    - role: letsencrypt_request
      tags: letsecrypt_request
      when: prosody_enable_muc
  tags:
    - never
    - prosody
    - test

- name: Get prosody subdomain Let's Encrypt certificate for http_upload
  hosts: all
  become: true
  gather_facts: false
  vars:
    domain: "{{ prosody_domain_upload }}"
    letsencrypt_renew_hook: /usr/sbin/service docker.prosody restart
  roles:
    - role: letsencrypt_request
      tags: letsecrypt_request
      when: prosody_enable_http_upload
  tags:
    - never
    - prosody
    - test

- name: Deploy prosody in docker
  hosts: all
  become: true
  gather_facts: false
  vars:
    create_volume: false
    service_name: prosody
    docker_image: "{{ prosody_docker_image }}"
    enable_db: false
    docker_command: |
      /usr/bin/docker run --rm --name {{ service_name }} \
      -v {{ prosody_directory.conf }}:/etc/prosody \
      -v {{ prosody_directory.data }}:/var/lib/prosody \
      -v {{ prosody_directory.modules_community }}:/usr/lib/prosody/modules-community \
      -v {{ prosody_directory.modules_custom }}:/usr/lib/prosody/modules-custom \
      -v {{ prosody_cert_path.privkey }}:/etc/prosody/certs/{{ prosody_domain }}.key:ro \
      -v {{ prosody_cert_path.cert }}:/etc/prosody/certs/{{ prosody_domain }}.crt:ro \
      -v '/etc/localtime:/etc/localtime:ro' \
      -p {{ prosody_port_c2s }}:5222 \
      -p {{ prosody_port_s2s }}:5269 \
      {% if prosody_enable_http %}
      -p {{ prosody_port_internal_http }}:5280 \
      {% endif %}
      --user 1000:1000 \
      "{{ docker_image }}"
  pre_tasks:
    - name: Create prosody directories
      file:
        path: "{{ item.value }}"
        state: directory
        owner: "{{ user_uid_1000 }}"
        group: "{{ group_gid_1000 }}"
        mode: 0700
      with_dict: "{{ prosody_directory }}"
    - name: Configure prosody
      template:
        src: prosody-conf.j2
        dest: "{{ prosody_directory.conf }}/prosody.cfg.lua"
        force: "{{ override | default('no') }}"
        owner: "{{ user_uid_1000 }}"
        group: "{{ group_gid_1000 }}"
        mode: 0600
  post_tasks:
    - name: Register jabber users
      expect:
        command: "docker exec -it {{ service_name }} prosodyctl adduser {{ item.jid }}"
        timeout: 60
        creates: "{{ prosody_directory.data }}/{{ item.jid.split('@') | last | replace('.', '%2e') }}/accounts/{{ item.jid.split('@') | first }}.dat"
        responses:
          "Enter new password:": "{{ item.pass }}"
          "Retype new password:": "{{ item.pass }}"
      with_items: "{{ prosody_users }}"
      no_log: true
    - name: Add iptables rules for prosody c2c
      iptables:
        chain: INPUT
        protocol: tcp
        ctstate: NEW
        match: tcp
        destination_port: "{{ prosody_port_c2s }}"
        jump: ACCEPT
        # comment: Prosody c2c
      notify: save iptables
      tags: iptables
    - name: Add iptables rules for prosody s2s
      iptables:
        chain: INPUT
        protocol: tcp
        ctstate: NEW
        match: tcp
        destination_port: "{{ prosody_port_s2s }}"
        jump: ACCEPT
        # comment: Prosody s2s
      notify: save iptables
      tags: iptables
    - name: Add iptables rules for prosody HTTPS
      iptables:
        chain: INPUT
        protocol: tcp
        ctstate: NEW
        match: tcp
        destination_port: "{{ prosody_port_external_https }}"
        jump: ACCEPT
        # comment: Prosody HTTPS
      when: prosody_enable_http
      notify: save iptables
      tags: iptables
  handlers:
    - name: save iptables
      command: netfilter-persistent save
  roles:
    - role: generic_docker_systemd
  tags:
    - never
    - prosody
    - test

- name: Configure nginx proxy for prosody http_upload
  hosts: all
  become: true
  gather_facts: false
  vars:
    domain: "{{ prosody_domain_upload }}"
    binded_port: "{{ prosody_port_internal_http }}"
    external_port: "{{ prosody_port_external_https }}"
  roles:
    - role: add_nginx_proxy_conf
      tags: proxy
      when: prosody_enable_http_upload
  tags:
    - never
    - prosody
    - test

## Gitea

- name: Deploy gitea in docker
  hosts: all
  become: true
  gather_facts: false
  vars:
    service_name: gitea
    docker_image: "{{ gitea_docker_image }}"
    docker_command: |
      /usr/bin/docker run --rm --name "{{ service_name }}" \
      -v "{{ gitea_directory.data }}":/data \
      -v '/etc/localtime:/etc/localtime:ro' \
      -p "{{ gitea_ssh_port }}:22" -p "{{ gitea_internal_web_port }}:3000" \
      -e "USER_UID=1000" -e "USER_GID=1000" \
      --network "{{ gitea_network }}" \
      "{{ docker_image }}"
    docker_service_directory_db: "{{ gitea_directory.db }}"
    service_db_name: "{{ gitea_db_service_name }}"
    db_name: "{{ gitea_db_name }}"
    db_user: "{{ gitea_db_user }}"
    db_user_pass: "{{ gitea_db_user_pass }}"
  pre_tasks:
    - name: Create gitea directories 755
      file:
        path: "{{ item }}"
        state: directory
        owner: "{{ user_uid_1000 }}"
        group: "{{ group_gid_1000 }}"
        mode: 0755
      with_items:
        - "{{ gitea_directory.data }}"
        - "{{ gitea_directory.conf }}"
        - "{{ gitea_directory.git_data }}"

    - name: Create gitea directories 700
      file:
        path: "{{ item }}"
        state: directory
        owner: "{{ user_uid_1000 }}"
        group: "{{ group_gid_1000 }}"
        mode: 0700
      with_items:
        - "{{ gitea_directory.db }}"
        - "{{ gitea_directory.ssh_data }}"

    - name: Configure gitea
      template:
        src: gitea-app.ini.j2
        dest: "{{ gitea_directory.data }}/gitea/conf/app.ini"
        force: "{{ override | default('no') }}"
        owner: "{{ user_uid_1000 }}"
        group: "{{ group_gid_1000 }}"
        mode: 0644
  post_tasks:
    - name: Add iptables rules for gitea
      become: true
      iptables:
        chain: INPUT
        protocol: tcp
        ctstate: NEW
        match: tcp
        destination_port: "{{ gitea_ssh_port  | default('2222')}}"
        jump: ACCEPT
        # comment: Gitea SSH
      notify: save iptables
      tags: iptables
  handlers:
    - name: save iptables
      command: netfilter-persistent save
  roles:
    - role: generic_docker_systemd
  tags:
    - never
    - gitea
    - test

- name: Get gitea subdomain Let's Encrypt certificate
  hosts: all
  become: true
  gather_facts: false
  vars:
    domain: "{{ gitea_domain }}"
    letsencrypt_renew_hook: /usr/sbin/service nginx reload
  roles:
    - role: letsencrypt_request
      tags: letsecrypt_request
  tags:
    - never
    - gitea
    - test

- name: Configure nginx proxy for gitea
  hosts: all
  become: true
  gather_facts: false
  vars:
    domain: "{{ gitea_domain }}"
    binded_port: "{{ gitea_internal_web_port }}"
  roles:
    - role: add_nginx_proxy_conf
      tags: proxy
  tags:
    - never
    - gitea
    - test

## CodiMD

- name: Deploy codimd in docker
  hosts: all
  become: true
  gather_facts: false
  vars:
    service_name: codimd
    docker_image: "{{ codimd_docker_image }}"
    docker_db_image: "{{ codimd_db_image }}"
    create_network: true
    db_type: postgres
    docker_service_directory_db: "{{ codimd_directory.db }}"
    db_user_pass: "{{ codimd_db_user_pass }}"
    db_config_port: 5432
    db_name: "{{ codimd_db_name }}"
    db_user: "{{ codimd_db_user }}"
    docker_command: |
      /usr/bin/docker run --rm --name "{{ service_name }}" \
      -p "{{ codimd_web_port }}:3000" \
      -e "USER_UID=1000" -e "USER_GID=1000" \
      -e "CMD_DB_URL=postgres://{{ codimd_db_user }}:{{ codimd_db_user_pass }}@{{ codimd_db_service_name }}:5432/{{ codimd_db_name }}" \
      -e "CMD_URL_ADDPORT=false" \
      {% if codimd_enable_ldap %}
      -e "CMD_LDAP_URL={{ codimd_ldap_url }}" \
      -e "CMD_LDAP_BINDDN={{ codimd_ldap_bind_dn }}" \
      -e "CMD_LDAP_BINDCREDENTIALS={{ codimd_ldap_bind_credentials }}" \
      -e "CMD_LDAP_SEARCHBASE={{ codimd_ldap_search_base }}" \
      -e "CMD_LDAP_SEARCHFILTER={{ codimd_ldap_search_filter }}" \
      -e "CMD_LDAP_SEARCHATTRIBUTES={{ codimd_ldap_search_attributes }}" \
      -e "CMD_LDAP_USERIDFIELD={{ codimd_ldap_user_field }}" \
      -e "CMD_LDAP_USERNAMEFIELD={{ codimd_ldap_user_name_field }}" \
      -e 'CMD_IMAGE_UPLOAD_TYPE=filesystem' \
      -e "CMD_LDAP_TLS_CA=/etc/ssl/certs/ca-certificates.crt" \
      -v "{{ ca_certs_path }}:/etc/ssl/certs/ca-certificates.crt:ro" \
      {% endif %}
      -v "{{ codimd_directory.uploads }}:/codimd/public/uploads/" \
      -v '/etc/localtime:/etc/localtime:ro' \
      --network "{{ codimd_network_name }}" \
      "{{ docker_image }}"
  pre_tasks:
    - name: Create codimd directory uploads
      file:
        path: "{{ codimd_directory.uploads }}"
        state: directory
        owner: "{{ user_uid_1000 }}"
        group: "{{ group_gid_1000 }}"
        mode: 0700
    - name: Create codimd directoriy db
      file:
        path: "{{ codimd_directory.db }}"
        state: directory
  roles:
    - role: generic_docker_systemd
  tags:
    - never
    - codimd
    - test

- name: Get codimd subdomain Let's Encrypt certificate
  hosts: all
  become: true
  gather_facts: false
  vars:
    domain: "{{ codimd_domain }}"
    letsencrypt_renew_hook: /usr/sbin/service nginx reload
  roles:
    - role: letsencrypt_request
      tags: letsecrypt_request
  tags:
    - never
    - codimd
    - test

- name: Configure nginx proxy for codimd
  hosts: all
  become: true
  gather_facts: false
  vars:
    domain: "{{ codimd_domain }}"
    binded_port: "{{ codimd_web_port }}"
  roles:
    - role: add_nginx_proxy_conf
      tags: proxy
  tags:
    - never
    - codimd
    - test

## Drone

- name: Deploy drone in docker
  hosts: all
  become: true
  gather_facts: false
  vars:
    enable_db: false
    service_name: drone
    docker_image: "{{ drone_docker_image }}"
    docker_command: |
      /usr/bin/docker run --rm --name "{{ service_name }}" \
      -v /var/run/docker.sock:/var/run/docker.sock \
      -v "{{ drone_directory.data }}":/data \
      -v '/etc/localtime:/etc/localtime:ro' \
      -p "{{ drone_internal_web_port }}:80" \
      -e "USER_UID=1000" -e "USER_GID=1000" \
      -e "DRONE_GITEA_SERVER=https://{{ gitea_domain }}" \
      -e "DRONE_GITEA_CLIENT_ID={{ gitea_oauth_client_id }}" \
      -e "DRONE_GITEA_CLIENT_SECRET={{ gitea_oauth_client_secret }}" \
      -e "DRONE_RPC_SECRET={{ drone_rpc_scret }}" \
      -e "DRONE_RUNNER_CAPACITY=2" \
      -e "DRONE_SERVER_HOST={{ drone_domain }}" \
      -e "DRONE_SERVER_PROTO=https" \
      -e "DRONE_TLS_AUTOCERT=false" \
      --network "{{ gitea_network }}" \
      "{{ docker_image }}"
  pre_tasks:
    - name: Create drone directories
      file:
        path: "{{ drone_directory.data }}"
        state: directory
        owner: "{{ user_uid_1000 }}"
        group: "{{ group_gid_1000 }}"
        mode: 0700
  roles:
    - role: generic_docker_systemd
  tags:
    - never
    - drone
    - test

- name: Get drone subdomain Let's Encrypt certificate
  hosts: all
  become: true
  gather_facts: false
  vars:
    domain: "{{ drone_domain }}"
    letsencrypt_renew_hook: /usr/sbin/service nginx reload
  roles:
    - role: letsencrypt_request
      tags: letsecrypt_request
  tags:
    - never
    - drone
    - test

- name: Configure nginx proxy for drone
  hosts: all
  become: true
  gather_facts: false
  vars:
    domain: "{{ drone_domain }}"
    binded_port: "{{ drone_internal_web_port }}"
  roles:
    - role: add_nginx_proxy_conf
      tags: proxy
  tags:
    - never
    - drone
    - test

## Drone docker runner

- name: Deploy drone docker runner in docker
  hosts: all
  become: true
  gather_facts: false
  vars:
    enable_db: false
    service_name: drone_docker_runner
    docker_image: "{{ drone_docker_runner_docker_image }}"
    docker_command: |
      /usr/bin/docker run --rm --name "{{ service_name }}" \
      -v /var/run/docker.sock:/var/run/docker.sock \
      -v '/etc/localtime:/etc/localtime:ro' \
      -p "{{ drone_docker_runner_internal_web_port }}:3000" \
      -e "DRONE_RPC_PROTO=https" \
      -e "DRONE_RPC_HOST={{ drone_domain }}" \
      -e "DRONE_RPC_SECRET={{ drone_rpc_scret }}" \
      -e "DRONE_RUNNER_CAPACITY=2" \
      -e "DRONE_RUNNER_NAME={{ drone_runner_name }}" \
      "{{ docker_image }}"
  roles:
    - role: generic_docker_systemd
  tags:
    - never
    - drone_ssh_runner
    - test

## Drone ssh runner

- name: Deploy drone ssh runner in docker
  hosts: all
  become: true
  gather_facts: false
  vars:
    enable_db: false
    service_name: drone_ssh_runner
    docker_image: "{{ drone_ssh_runner_docker_image }}"
    docker_command: |
      /usr/bin/docker run --rm --name "{{ service_name }}" \
      -p "{{ drone_ssh_runner_internal_web_port }}:3000" \
      -e "DRONE_RPC_PROTO=https" \
      -e "DRONE_RPC_HOST={{ drone_domain }}" \
      -e "DRONE_RPC_SECRET={{ drone_rpc_scret }}" \
      "{{ docker_image }}"
  roles:
    - role: generic_docker_systemd
  tags:
    - never
    - drone_ssh_runner
    - test

## Drone for GitHub

- name: Deploy drone for github in docker
  hosts: all
  become: true
  gather_facts: false
  vars:
    enable_db: false
    service_name: drone_github
    docker_image: "{{ drone_github_docker_image }}"
    docker_command: |
      /usr/bin/docker run --rm --name "{{ service_name }}" \
      -v /var/run/docker.sock:/var/run/docker.sock \
      -v "{{ drone_github_directory.data }}":/data \
      -v '/etc/localtime:/etc/localtime:ro' \
      -p "{{ drone_github_internal_web_port }}:80" \
      -e "USER_UID=1000" -e "USER_GID=1000" \
      -e "DRONE_GITHUB_SERVER=https://github.com" \
      -e "DRONE_GITHUB_CLIENT_ID={{ drone_github_client_id }}" \
      -e "DRONE_GITHUB_CLIENT_SECRET={{ drone_github_client_secret }}" \
      -e "DRONE_RUNNER_CAPACITY=2" \
      -e "DRONE_SERVER_HOST={{ drone_github_domain }}" \
      -e "DRONE_SERVER_PROTO=https" \
      -e "DRONE_TLS_AUTOCERT=false" \
      --network "{{ gitea_network }}" \
      "{{ docker_image }}"
  pre_tasks:
    - name: Create drone_github directories
      file:
        path: "{{ drone_github_directory.data }}"
        state: directory
        owner: "{{ user_uid_1000 }}"
        group: "{{ group_gid_1000 }}"
        mode: 0700
  roles:
    - role: generic_docker_systemd
  tags:
    - never
    - drone_github
    - test

- name: Get drone_github subdomain Let's Encrypt certificate
  hosts: all
  become: true
  gather_facts: false
  vars:
    domain: "{{ drone_github_domain }}"
    letsencrypt_renew_hook: /usr/sbin/service nginx reload
  roles:
    - role: letsencrypt_request
      tags: letsecrypt_request
  tags:
    - never
    - drone_github
    - test

- name: Configure nginx proxy for drone_github
  hosts: all
  become: true
  gather_facts: false
  vars:
    domain: "{{ drone_github_domain }}"
    binded_port: "{{ drone_github_internal_web_port }}"
  roles:
    - role: add_nginx_proxy_conf
      tags: proxy
  tags:
    - never
    - drone_github
    - test

## Transmission

- name: Deploy transmission in docker
  hosts: all
  become: true
  gather_facts: false
  vars:
    enable_db: false
    service_name: transmission
    create_volume: false
    docker_image: "{{ transmission_docker_image }}"
    docker_command: |
      /usr/bin/docker run --rm --name "{{ service_name }}" \
      -v "{{ transmission_directory.conf }}":/config \
      -v "{{ transmission_directory.downloads }}":/downloads \
      -v "{{ transmission_directory.watch }}":/watch \
      -v '/etc/localtime:/etc/localtime:ro' \
      -e "PGID=1000" -e "PUID=1000" \
      -e "TZ={{ transmission_timezone }}" \
      -p "{{ transmission_internal_web_port }}:9091" \
      -p 51413:51413/tcp \
      -p 51413:51413/udp \
      "{{ docker_image }}"
  pre_tasks:
    - name: Create transmission directories
      file:
        path: "{{ item.value }}"
        state: directory
        owner: "{{ user_uid_1000 }}"
        group: "{{ group_gid_1000 }}"
        mode: 0700
      with_dict: "{{ transmission_directory }}"

    - name: Configure transmission
      template:
        src: transmission-settings.json.j2
        dest: "{{ transmission_directory.conf }}/settings.json"
        force: "{{ override | default('no') }}"
  post_tasks:
    - name: Add iptables rules for transmission TCP
      iptables:
        chain: INPUT
        protocol: tcp
        ctstate: NEW
        match: tcp
        destination_port: "{{ transmission_peer_port }}"
        jump: ACCEPT
        # comment: Transmission TCP
      notify: save iptables
      tags: iptables
    - name: Add iptables rules for transmission UDP
      iptables:
        chain: INPUT
        protocol: udp
        ctstate: NEW
        match: udp
        destination_port: "{{ transmission_peer_port }}"
        jump: ACCEPT
        # comment: Transmission UDP
      notify: save iptables
      tags: iptables
  handlers:
    - name: save iptables
      command: netfilter-persistent save
  roles:
    - role: generic_docker_systemd
  tags:
    - never
    - transmission
    - test

- name: Get transmission subdomain Let's Encrypt certificate
  hosts: all
  become: true
  gather_facts: false
  vars:
    domain: "{{ transmission_domain }}"
    letsencrypt_renew_hook: /usr/sbin/service nginx reload
  roles:
    - role: letsencrypt_request
      tags: letsecrypt_request
  tags:
    - never
    - transmission
    - test

- name: Configure nginx proxy for transmission
  hosts: all
  become: true
  gather_facts: false
  vars:
    domain: "{{ transmission_domain }}"
    binded_port: "{{ transmission_internal_web_port }}"
  roles:
    - role: add_nginx_proxy_conf
      tags: proxy
  tags:
    - never
    - transmission
    - test

## Transmission-OpenVPN

- name: Deploy transmission_openvpn in docker
  hosts: all
  become: true
  gather_facts: false
  vars:
    enable_db: false
    service_name: transmission_openvpn
    create_volume: false
    docker_image: "{{ transmission_openvpn_docker_image }}"
    docker_command: |
      /usr/bin/docker run --rm --name "{{ service_name }}" \
      -v "{{ transmission_openvpn_directory.data }}":/data \
      -v /etc/localtime:/etc/localtime:ro \
      -e "PGID=1000" -e "PUID=1000" \
      -e CREATE_TUN_DEVICE=true \
      -e OPENVPN_PROVIDER={{ transmission_openvpn_vpn.provider }} \
      -e OPENVPN_CONFIG={{ transmission_openvpn_vpn.conf }} \
      -e OPENVPN_USERNAME={{ transmission_openvpn_vpn.user }} \
      -e OPENVPN_PASSWORD={{ transmission_openvpn_vpn.pass }} \
      -e TRANSMISSION_RPC_AUTHENTICATION_REQUIRED=true \
      -e TRANSMISSION_RPC_USERNAME={{ transmission_openvpn_rpc.user }} \
      -e TRANSMISSION_RPC_PASSWORD={{ transmission_openvpn_rpc.pass }} \
      -e WEBPROXY_ENABLED=false \
      {% for env_var in transmission_openvpn_extra_env -%}
      -e {{ env_var }} \
      {% endfor -%}
      -p {{ transmission_openvpn_internal_web_port }}:9091 \
      -p 51413:51413/tcp \
      -p 51413:51413/udp \
      --cap-add=NET_ADMIN \
      --dns {{ transmission_openvpn_dns }} \
      {{ docker_image }}
  pre_tasks:
    - name: Create transmission_openvpn directories
      file:
        path: "{{ item.value }}"
        state: directory
        owner: "{{ user_uid_1000 }}"
        group: "{{ group_gid_1000 }}"
        mode: 0700
      with_dict: "{{ transmission_openvpn_directory }}"
  roles:
    - role: generic_docker_systemd
  tags:
    - never
    - transmission_openvpn
    - test

- name: Get transmission_openvpn subdomain Let's Encrypt certificate
  hosts: all
  become: true
  gather_facts: false
  vars:
    domain: "{{ transmission_openvpn_domain }}"
    letsencrypt_renew_hook: /usr/sbin/service nginx reload
  roles:
    - role: letsencrypt_request
      tags: letsecrypt_request
  tags:
    - never
    - transmission_openvpn
    - test

- name: Configure nginx proxy for transmission_openvpn
  hosts: all
  become: true
  gather_facts: false
  vars:
    domain: "{{ transmission_openvpn_domain }}"
    binded_port: "{{ transmission_openvpn_internal_web_port }}"
  roles:
    - role: add_nginx_proxy_conf
      tags: proxy
  tags:
    - never
    - transmission_openvpn
    - test

## Wallabag

- name: Deploy wallabag in docker
  hosts: all
  become: true
  gather_facts: false
  vars:
    create_volume: false
    service_name: wallabag
    docker_image: "{{ wallabag_docker_image }}"
    create_user_and_db: false
    docker_command: |
      /usr/bin/docker run --rm --name "{{ service_name }}" \
      -p "{{ wallabag_internal_web_port }}:80" \
      -v "{{ wallabag_directory.images }}":/var/www/wallabag/web/assets/images \
      -v '/etc/localtime:/etc/localtime:ro' \
      --network "{{ service_name }}" \
      -e "MYSQL_ROOT_PASSWORD={{ db_pass }}" \
      -e "SYMFONY__ENV__DOMAIN_NAME=https://{{ wallabag_domain }}" \
      -e "SYMFONY__ENV__FOSUSER_CONFIRMATION=false" \
      -e "SYMFONY__ENV__DATABASE_DRIVER=pdo_mysql" \
      -e "SYMFONY__ENV__DATABASE_HOST={{ service_db_name }}" \
      -e "SYMFONY__ENV__DATABASE_PORT=3306" \
      -e "SYMFONY__ENV__DATABASE_NAME={{ wallabag_db_name }}" \
      -e "SYMFONY__ENV__DATABASE_USER={{ wallabag_db_user }}" \
      -e "SYMFONY__ENV__DATABASE_PASSWORD={{ wallabag_db_user_pass }}" \
      "{{ docker_image }}"
    docker_service_directory_db: "{{ wallabag_directory.db }}"
    service_db_name: "{{ wallabag_db_service_name }}"
    db_name: "{{ wallabag_db_name }}"
    db_user: "{{ wallabag_db_user }}"
    db_user_pass: "{{ wallabag_db_user_pass }}"
  pre_tasks:
    - name: "Create wallabag directories nobody:nogroup"
      file:
        path: "{{ wallabag_directory.images }}"
        state: directory
        owner: nobody
        group: nogroup
        mode: 0700
    - name: Create wallabag directories 700
      file:
        path: "{{ wallabag_directory.db }}"
        state: directory
        owner: "{{ user_uid_1000 }}"
        group: "{{ group_gid_1000 }}"
        mode: 0700
  roles:
    - role: generic_docker_systemd
  tags:
    - never
    - wallabag
    - test

- name: Get wallabag subdomain Let's Encrypt certificate
  hosts: all
  become: true
  gather_facts: false
  vars:
    domain: "{{ wallabag_domain }}"
    letsencrypt_renew_hook: /usr/sbin/service nginx reload
  roles:
    - role: letsencrypt_request
      tags: letsecrypt_request
  tags:
    - never
    - wallabag
    - test

- name: Configure nginx proxy for wallabag
  hosts: all
  become: true
  gather_facts: false
  vars:
    domain: "{{ wallabag_domain }}"
    binded_port: "{{ wallabag_internal_web_port }}"
  roles:
    - role: add_nginx_proxy_conf
      tags: proxy
  tags:
    - never
    - wallabag
    - test

## Syncthing

- name: Deploy syncthing in docker
  hosts: all
  become: true
  gather_facts: false
  vars:
    create_volume: false
    service_name: syncthing
    docker_image: "{{ syncthing_docker_image }}"
    enable_db: false
    docker_command: |
      /usr/bin/docker run --rm --name "{{ service_name }}" \
      -v "{{ syncthing_directory.conf }}":/var/syncthing/config \
      -v "{{ syncthing_directory.data }}":/var/syncthing \
      -v '/etc/localtime:/etc/localtime:ro' \
      -p "{{ syncthing_internal_web_port }}:8384" \
      -p "{{ syncthing_listening_port }}:22000" \
      -p "{{ syncthing_discovery_port }}:21027/udp" \
      "{{ docker_image }}"
  pre_tasks:
    - name: Create syncthing directories
      file:
        path: "{{ item.value }}"
        state: directory
        owner: "{{ user_uid_1000 }}"
        group: "{{ group_gid_1000 }}"
        mode: 0700
      with_dict: "{{ syncthing_directory }}"
  post_tasks:
    - name: Add iptables rules for syncthing discovery
      iptables:
        chain: INPUT
        protocol: udp
        ctstate: NEW
        match: udp
        destination_port: "{{ syncthing_discovery_port }}"
        jump: ACCEPT
        # comment: Syncthing discovery
      notify: save iptables
      tags: iptables
    - name: Add iptables rules for syncthing listening
      iptables:
        chain: INPUT
        protocol: tcp
        ctstate: NEW
        match: tcp
        destination_port: "{{ syncthing_listening_port }}"
        jump: ACCEPT
        # comment: Syncthing listening
      notify: save iptables
      tags: iptables
  handlers:
    - name: save iptables
      command: netfilter-persistent save
  roles:
    - role: generic_docker_systemd
  tags:
    - never
    - syncthing
    - test

- name: Get syncthing subdomain Let's Encrypt certificate
  hosts: all
  become: true
  gather_facts: false
  vars:
    domain: "{{ syncthing_domain }}"
    letsencrypt_renew_hook: /usr/sbin/service nginx reload
  roles:
    - role: letsencrypt_request
      tags: letsecrypt_request
  tags:
    - never
    - syncthing
    - test

- name: Configure nginx proxy for syncthing
  hosts: all
  become: true
  gather_facts: false
  vars:
    domain: "{{ syncthing_domain }}"
    binded_port: "{{ syncthing_internal_web_port }}"
  roles:
    - role: add_nginx_proxy_conf
      tags: proxy
  tags:
    - never
    - syncthing
    - test

## OpenVPN

- name: Deploy openvpn in docker
  hosts: all
  become: true
  gather_facts: false
  vars:
    create_volume: false
    service_name: openvpn
    docker_image: "{{ openvpn_docker_image }}"
    enable_db: false
    docker_command: |
      /usr/bin/docker run --rm --name "{{ service_name }}" \
      -v "{{ openvpn_directory.conf }}":/etc/openvpn \
      -v '/etc/localtime:/etc/localtime:ro' \
      --cap-add=NET_ADMIN \
      -p "{{ openvpn_port }}:1194/{{ openvpn_protocol }}" \
      "{{ docker_image }}"
  pre_tasks:
    - name: Create openvpn directories
      file:
        path: "{{ item.value }}"
        state: directory
        owner: "{{ user_uid_1000 }}"
        group: "{{ group_gid_1000 }}"
        mode: 0700
      with_dict: "{{ openvpn_directory }}"
      notify: Configure openvpn container
  post_tasks:
    - name: Add iptables rules for openvpn
      iptables:
        chain: INPUT
        protocol: "{{ openvpn_protocol }}"
        ctstate: NEW
        match: "{{ openvpn_protocol }}"
        destination_port: "{{ openvpn_port }}"
        jump: ACCEPT
        # comment: OpenVPN
      notify: save iptables
      tags: iptables
  handlers:
    - name: Configure openvpn container
      command: "{{ openvpn_confiure_docker_command }}"
      notify: Create openvpn CA
      #  docker_container:
      #    image: "{{ openvpn_docker_image }}"
      #    name: openvpn-conf
      #    cleanup: true
      #    command: "ovpn_genconfig -u {{ openvpn_protocol }}://{{ openvpn_domain }}"
    - name: Create openvpn CA
      expect:
        command: "{{ openvpn_create_ca_command }}"
        timeout: 600
        responses:
          "Enter PEM pass phrase": "{{ openvpn_ca_pass }}"
          "Verifying - Enter PEM pass phrase": "{{ openvpn_ca_pass }}"
          "Common Name": "{{ openvpn_ca_cn }}"
          "Enter pass phrase for": "{{ openvpn_ca_pass }}"
    - name: save iptables
      command: netfilter-persistent save
  roles:
    - role: generic_docker_systemd
  tags:
    - never
    - openvpn
    - test

## Radicale

- name: Deploy radicale in docker
  hosts: all
  become: true
  gather_facts: false
  vars:
    create_volume: false
    service_name: radicale
    docker_image: "{{ radicale_docker_image }}"
    enable_db: false
    docker_command: |
      /usr/bin/docker run --rm --name "{{ service_name }}" \
      -e UID=1000 -e GID=1000 \
      -p "127.0.0.1:5232:{{ radicale_internal_web_port }}" \
      --init \
      --pids-limit 50 \
      --memory 256M \
      --health-cmd="curl --fail http://localhost:5232 || exit 1" \
      --health-interval=30s \
      --health-retries=3 \
      -v "{{ radicale_directory.data }}":/data \
      -v "{{ radicale_directory.etc }}":/etc/radicale \
      -v "{{ radicale_directory.conf }}":/config:ro \
      -v '/etc/localtime:/etc/localtime:ro' \
      "{{ docker_image }}"
  pre_tasks:
    - name: Create radicale directories
      file:
        path: "{{ item.value }}"
        state: directory
        owner: "{{ user_uid_1000 }}"
        group: "{{ group_gid_1000 }}"
        mode: 0700
      with_dict: "{{ radicale_directory }}"

    - name: Copy radicale configuration template
      template:
        src: radicale-config.j2
        dest: "{{ radicale_directory.conf }}/config"
        owner: "{{ user_uid_1000 }}"
        group: "{{ group_gid_1000 }}"
        mode: 0700

    - name: Add radicale login credentiasl
      lineinfile:
        path: "{{ radicale_directory.etc }}/users"
        line: "{{ radicale_user }}:{{ radicale_pass }}"
        owner: "{{ user_uid_1000 }}"
        group: "{{ group_gid_1000 }}"
        mode: 0700
        create: true
  roles:
    - role: generic_docker_systemd
  tags:
    - never
    - radicale
    - test

- name: Get radicale subdomain Let's Encrypt certificate
  hosts: all
  become: true
  gather_facts: false
  vars:
    domain: "{{ radicale_domain }}"
    letsencrypt_renew_hook: /usr/sbin/service nginx reload
  roles:
    - role: letsencrypt_request
      tags: letsecrypt_request
  tags:
    - never
    - radicale
    - test

- name: Configure nginx proxy for radicale
  hosts: all
  become: true
  gather_facts: false
  vars:
    domain: "{{ radicale_domain }}"
    binded_port: "{{ radicale_internal_web_port }}"
    proxy_conf: |
      proxy_pass        http://127.0.0.1:{{ binded_port }};
      proxy_set_header  X-Script-Name /;
      proxy_set_header  X-Forwarded-For $proxy_add_x_forwarded_for;
      proxy_pass_header Authorization;
  roles:
    - role: add_nginx_proxy_conf
      tags: proxy
  tags:
    - never
    - radicale
    - test

## taskd

- name: Deploy taskd in docker
  hosts: all
  become: true
  gather_facts: false
  vars:
    create_volume: false
    enable_db: false
    service_name: taskd
    docker_image: "{{ taskd_docker_image }}"
    docker_command: |
      /usr/bin/docker run --rm --name "{{ service_name }}" \
      -v "{{ taskd_directory.data }}":/var/taskd \
      -v '/etc/localtime:/etc/localtime:ro' \
      -p "{{ taskd_port }}:53589" \
      "{{ docker_image }}"
  pre_tasks:
    - name: Create taskd directories
      file:
        path: "{{ item.value }}"
        state: directory
        owner: "{{ user_uid_1000 }}"
        group: "{{ group_gid_1000 }}"
        mode: 0700
      with_dict: "{{ taskd_directory }}"
  post_tasks:
    - name: Add iptables rules for taskd
      iptables:
        chain: INPUT
        protocol: tcp
        ctstate: NEW
        match: tcp
        destination_port: "{{ taskd_port | default('53589') }}"
        jump: ACCEPT
        # comment: taskd
      notify: save iptables
      tags: iptables
  handlers:
    - name: save iptables
      command: netfilter-persistent save
  roles:
    - role: generic_docker_systemd
  tags:
    - never
    - taskd
    - test

## Nextcloud

- name: Deploy nextcloud in docker
  hosts: all
  become: true
  gather_facts: false
  vars:
    service_name: nextcloud
    docker_image: "{{ nextcloud_docker_image }}"
    create_volume: false
    docker_service_directory_db: "{{ nextcloud_directory.db }}"
    service_db_name: "{{ nextcloud_db_service_name }}"
    db_name: "{{ nextcloud_db_name }}"
    db_user: "{{ nextcloud_db_user }}"
    db_user_pass: "{{ nextcloud_db_user_pass }}"
    docker_command: |
      /usr/bin/docker run --rm --name "{{ service_name }}" \
      -v "{{ nextcloud_directory.data }}":/var/www/html \
      -v '/etc/localtime:/etc/localtime:ro' \
      -p "{{ nextcloud_internal_web_port }}:80" \
      -e "MYSQL_HOST={{ service_db_name }}" \
      -e "MYSQL_DATABASE={{ db_name }}" \
      -e "MYSQL_USER={{ db_user }}" \
      -e "MYSQL_PASSWORD={{ db_user_pass }}" \
      --network "{{ service_name }}" \
      "{{ docker_image }}"
  pre_tasks:
    - name: Create nextcloud directories 750 uid 33
      become: true
      file:
        path: "{{ item }}"
        state: directory
        owner: "{{ user_uid_33 }}"
        group: 0
        mode: 0750
      with_items:
        - "{{ nextcloud_directory.data }}"
    - name: Create nextcloud directories 700
      become: true
      file:
        path: "{{ item }}"
        state: directory
        owner: "{{ user_uid_1000 }}"
        group: "{{ group_gid_1000 }}"
        mode: 0700
      with_items:
        - "{{ nextcloud_directory.db }}"
  roles:
    - role: generic_docker_systemd
  tags:
    - never
    - nextcloud
    - test

- name: Get nextcloud subdomain Let's Encrypt certificate
  hosts: all
  become: true
  gather_facts: false
  vars:
    domain: "{{ nextcloud_domain }}"
    letsencrypt_renew_hook: /usr/sbin/service nginx reload
  roles:
    - role: letsencrypt_request
      tags: letsecrypt_request
  tags:
    - never
    - nextcloud
    - test

- name: Configure nginx proxy for nextcloud
  hosts: all
  become: true
  gather_facts: false
  vars:
    domain: "{{ nextcloud_domain }}"
    binded_port: "{{ nextcloud_internal_web_port }}"
  roles:
    - role: add_nginx_proxy_conf
      tags: proxy
  tags:
    - never
    - nextcloud
    - test

## Taiga

- name: Deploy taiga in docker
  hosts: all
  become: true
  gather_facts: false
  vars:
    service_name: taiga
    docker_image: "{{ taiga_docker_image }}"
    docker_db_image: "{{ taiga_db_image }}"
    create_network: true
    create_volume: false
    db_type: postgres
    docker_service_directory_db: "{{ taiga_directory.db }}"
    db_user_pass: "{{ taiga_db_user_pass }}"
    db_config_port: 5432
    db_name: "{{ taiga_db_name }}"
    db_user: "{{ taiga_db_user }}"
    docker_command: |
      /usr/bin/docker run --rm --name "{{ service_name }}" \
      -p "{{ taiga_internal_web_port }}:80" \
      -e "TAIGA_HOSTNAME={{ taiga_domain }}" \
      -e 'TAIGA_SSL=true' \
      -e "TAIGA_SECRET_KEY={{ taiga_secret_key }}" \
      -e 'TAIGA_DB_HOST=taiga-db' \
      -e "TAIGA_DB_NAME={{ db_name }}" \
      -e "TAIGA_DB_USER={{ db_user }}" \
      -e "TAIGA_DB_PASSWORD={{ db_user_pass }}" \
      -e "TAIGA_DEFAULT_FROM_EMAIL={{ taiga_default_from_email }}" \
      -e "TAIGA_EMAIL_BACKEND={{ taiga_email_backend }}" \
      -e "TAIGA_EMAIL_USE_TLS={{ taiga_email_use_tls }}" \
      -e "TAIGA_EMAIL_USE_SSL={{ taiga_email_use_ssl }}" \
      -e "TAIGA_EMAIL_HOST={{ taiga_email_host }}" \
      -e "TAIGA_EMAIL_PORT={{ taiga_email_port }}" \
      -e "TAIGA_EMAIL_HOST_USER={{ taiga_email_host_user }}" \
      -e "TAIGA_EMAIL_HOST_PASSWORD={{ taiga_email_host_password }}" \
      {% if taiga_enable_ldap %}
      -e 'LDAP_ENABLE=true' \
      -e "LDAP_SERVER={{ taiga_ldap_server }}" \
      -e "LDAP_PORT={{ taiga_ldap_port }}" \
      -e "LDAP_BIND_dn={{ taiga_ldap_bind_dn }}" \
      -e "LDAP_BIND_PASSWORD={{ taiga_ldap_bind_credentials }}" \
      -e "LDAP_SEARCH_BASE={{ taiga_ldap_search_base }}" \
      -e "LDAP_SEARCH_PROPERTY={{ taiga_ldap_search_property }}" \
      -e "LDAP_EMAIL_PROPERTY={{ taiga_ldap_email_attribute }}" \
      -e "LDAP_FULL_NAME_PROPERTY={{ taiga_ldap_full_name_attribute }}" \
      -e "TAIGA_BACKEND_WEBHOOKS_ENABLED={{ taiga_backend_webhooks_enabled }}" \
      {% endif %}
      -v "{{ taiga_directory.media }}:/taiga.io/taiga-back/media" \
      -v '/etc/localtime:/etc/localtime:ro' \
      --network "{{ service_name }}" \
      "{{ docker_image }}"
  pre_tasks:
    - name: Create taiga directories
      file:
        path: "{{ item.value }}"
        state: directory
        mode: 0700
        owner: "{{ user_uid_1000 }}"
        group: "{{ group_gid_1000 }}"
      with_dict: "{{ taiga_directory }}"
  roles:
    - role: generic_docker_systemd
  tags:
    - never
    - taiga
    - test

- name: Get taiga subdomain Let's Encrypt certificate
  hosts: all
  become: true
  gather_facts: false
  vars:
    domain: "{{ taiga_domain }}"
    letsencrypt_renew_hook: /usr/sbin/service nginx reload
  roles:
    - role: letsencrypt_request
      tags: letsecrypt_request
  tags:
    - never
    - taiga
    - test

- name: Configure nginx proxy for taiga
  hosts: all
  become: true
  gather_facts: false
  vars:
    domain: "{{ taiga_domain }}"
    binded_port: "{{ taiga_internal_web_port }}"
  roles:
    - role: add_nginx_proxy_conf
      tags: proxy
  tags:
    - never
    - taiga
    - test

## NFS

- name: Deploy nfs in docker
  hosts: all
  become: true
  gather_facts: false
  vars:
    service_name: nfs
    docker_image: "{{ nfs_docker_image }}"
    enable_db: false
    create_network: false
    create_volume: false
    docker_command: |
      /usr/bin/docker run --rm --name "{{ service_name }}" \
      --cap-add SYS_ADMIN \
      -v "{{ nfs_directory.conf }}/exports":/etc/exports:ro \
      -v '/etc/localtime:/etc/localtime:ro' \
      {{ nfs_export_volumes }}-p "{{ nfs_port | default('2049') }}:2049" \
      "{{ docker_image }}"
  pre_tasks:
    - name: Create nfs directories
      file:
        path: "{{ item.value }}"
        state: directory
        owner: "{{ user_uid_1000 }}"
        group: "{{ group_gid_1000 }}"
        mode: 0700
      with_dict: "{{ nfs_directory }}"

    - name: Create nfs user mount directories
      file:
        path: "{{ item.value }}"
        state: directory
        owner: "{{ user_uid_1000 }}"
        group: "{{ group_gid_1000 }}"
        mode: 0700
      with_dict: "{{ nfs_user_mounts }}"
      when: nfs_user_mounts is defined

    - name: Create nfs configuration file
      file:
        path: "{{ nfs_directory.conf }}/exports"
        state: touch
        owner: "{{ user_uid_1000 }}"
        group: "{{ group_gid_1000 }}"
        mode: 0700
        modification_time: "preserve"
        access_time: "preserve"

    - name: Configure nfs
      blockinfile:
        block: "{{ nfs_exports_conf }}"
        path: "{{ nfs_directory.conf }}/exports"

    - name: Load kernel modules for nfs
      become: true
      modprobe:
        name: "{{ item }}"
        state: present
      with_items:
        - nfs
        - nfsd

    - name: Load kernel modules for nfs at boot
      become: true
      lineinfile:
        path: /etc/modules
        state: present
        line: "{{ item }}"
      with_items:
        - nfs
        - nfsd
  post_tasks:
    - name: Add iptables rules for nfs
      iptables:
        chain: INPUT
        protocol: tcp
        ctstate: NEW
        match: tcp
        destination_port: "{{ nfs_port | default('2049') }}"
        jump: ACCEPT
        # comment: NFS
      notify: save iptables
      tags: iptables
  handlers:
    - name: save iptables
      command: netfilter-persistent save
  roles:
    - role: generic_docker_systemd
  tags:
    - never
    - nfs
    - test

## BIND DNS Server

- name: Deploy bind_dns_server in docker
  hosts: all
  become: true
  gather_facts: false
  vars:
    create_volume: false
    enable_db: false
    create_network: true
    service_name: bind_dns_server
    docker_image: "{{ bind_dns_server_docker_image }}"
    container_certs_path: /container/service/slapd/assets/certs
    docker_command: |
      /usr/bin/docker run --rm --name "{{ service_name }}" \
      -v {{ bind_dns_server_directory.data }}:/data \
      -v '/etc/localtime:/etc/localtime:ro' \
      -p {{ bind_dns_server_port }}:53/tcp \
      -p {{ bind_dns_server_port }}:53/udp \
      -e WEBMIN_ENABLED=false \
      --network {{ service_name }} \
      {{ docker_image }}
  pre_tasks:
    - name: Create bind_dns_server directories
      file:
        path: "{{ item.value }}"
        owner: "{{ user_uid_101 }}"
        group: "{{ group_gid_101 }}"
        state: directory
        mode: 0771
      with_dict: "{{ bind_dns_server_directory }}"
  post_tasks:
    - name: Add iptables rules for BIND DNS TCP
      iptables:
        chain: INPUT
        protocol: tcp
        ctstate: NEW
        match: tcp
        destination_port: "{{ bind_dns_server_port }}"
        jump: ACCEPT
        # comment: BIND DNS TCP
      notify: save iptables
      tags: iptables
    - name: Add iptables rules for BIND DNS UDP
      iptables:
        chain: INPUT
        protocol: udp
        ctstate: NEW
        match: udp
        destination_port: "{{ bind_dns_server_port }}"
        jump: ACCEPT
        # comment: BIND DNS UDP
      notify: save iptables
      tags: iptables
  handlers:
    - name: save iptables
      command: netfilter-persistent save
  roles:
    - role: generic_docker_systemd
  tags:
    - never
    - bind_dns_server
    - test

## Murmur

- name: Get murmur subdomain Let's Encrypt certificate
  hosts: all
  become: true
  gather_facts: false
  vars:
    domain: "{{ murmur_domain }}"
    letsencrypt_renew_hook: /usr/sbin/service docker.murmur.service restart
  roles:
    - role: letsencrypt_request
      tags: letsecrypt_request
  tags:
    - never
    - murmur
    - test

- name: Deploy murmur in docker
  hosts: all
  become: true
  gather_facts: false
  vars:
    create_volume: false
    service_name: murmur
    docker_image: "{{ murmur_docker_image }}"
    enable_db: false
    docker_command: |
      /usr/bin/docker run --rm --name "{{ service_name }}" \
      -e 'PUID=1000' -e 'PGID=1000' \
      -e 'RUN_CHOWN=false' \
      -e "CERTDIR=/etc/letsencrypt/live/{{ murmur_domain }}" \
      -v "{{ murmur_directory.conf }}":/opt/murmur/config \
      -v "{{ murmur_directory.data }}":/opt/murmur/data \
      -v "{{ murmur_directory.log }}":/opt/murmur/log \
      -v '/etc/localtime:/etc/localtime:ro' \
      -v /etc/letsencrypt/live/{{ murmur_domain }}:/etc/letsencrypt/live/{{ murmur_domain }}/:ro \
      -v /etc/letsencrypt/archive/{{ murmur_domain }}:/etc/letsencrypt/archive/{{ murmur_domain }}/:ro \
      -p "{{ murmur_port }}:64738/tcp" \
      -p "{{ murmur_port }}:64738/udp" \
      "{{ docker_image }}"
  pre_tasks:
    - name: Create murmur directories
      file:
        path: "{{ item.value }}"
        state: directory
        owner: "{{ user_uid_1000 }}"
        group: "{{ group_gid_1000 }}"
        mode: 0700
      with_dict: "{{ murmur_directory }}"
  post_tasks:
    - name: Add iptables rules for murmur TCP
      iptables:
        chain: INPUT
        protocol: tcp
        ctstate: NEW
        match: tcp
        destination_port: "{{ murmur_port }}"
        jump: ACCEPT
        # comment: Murmur UDP
      notify: save iptables
      tags: iptables
    - name: Add iptables rules for murmur UDP
      iptables:
        chain: INPUT
        protocol: udp
        ctstate: NEW
        match: udp
        destination_port: "{{ murmur_port }}"
        jump: ACCEPT
        # comment: Murmur UDP
      notify: save iptables
      tags: iptables
  handlers:
    - name: save iptables
      command: netfilter-persistent save
  roles:
    - role: generic_docker_systemd
  tags:
    - never
    - murmur
    - test

## InfluxDB

- name: Deploy influxdb in docker
  hosts: all
  become: true
  gather_facts: false
  vars:
    create_volume: false
    service_name: influxdb
    docker_image: "{{ influxdb_docker_image }}"
    enable_db: false
    create_network: true
    docker_command: |
      /usr/bin/docker run --rm --name "{{ service_name }}" \
      --user 1000:1000 \
      -v "{{ influxdb_directory.data }}":/var/lib/influxdb \
      -v '/etc/localtime:/etc/localtime:ro' \
      -p "{{ influxdb_port }}:8086" \
      --network {{ service_name }} \
      "{{ docker_image }}"
  pre_tasks:
    - name: Create influxdb directories
      file:
        path: "{{ item.value }}"
        state: directory
        owner: "{{ user_uid_1000 }}"
        group: "{{ group_gid_1000 }}"
        mode: 0700
      with_dict: "{{ influxdb_directory }}"
    - name: Check if influxdb is already configured
      stat:
        path: "{{ influxdb_directory.data }}/data"
      register: database_influxdb_conf
    - name: Configure influxdb
      docker_container:
        image: "{{ influxdb_docker_image }}"
        name: influxdb-conf
        cleanup: true
        user: 1000:1000
        volumes:
          - "{{ influxdb_directory.data }}:/var/lib/influxdb"
        env:
          INFLUXDB_DB: "{{ influxdb_db }}"
          INFLUXDB_ADMIN_USER: "{{ influxdb_admin_user }}"
          INFLUXDB_ADMIN_PASSWORD: "{{ influxdb_admin_password }}"
          INFLUXDB_USER: "{{ influxdb_user }}"
          INFLUXDB_USER_PASSWORD: "{{ influxdb_user_password }}"
        ports:
          - "{{ influxdb_port }}:8086"
      when: not database_influxdb_conf.stat.exists
    - name: Wait for configuration container to finish setting up
      wait_for:
        port: "{{ influxdb_port }}"
      when: not database_influxdb_conf.stat.exists
    - name: Remove configuration container
      docker_container:
        name: influxdb-conf
        state: absent
      when: not database_influxdb_conf.stat.exists
  post_tasks:
    - name: Add iptables rules for influxdb
      iptables:
        chain: INPUT
        protocol: tcp
        ctstate: NEW
        match: tcp
        destination_port: "{{ influxdb_port }}"
        jump: ACCEPT
        # comment: InfluxDB
      when: influxdb_open_port
      notify: save iptables
      tags: iptables
  handlers:
    - name: save iptables
      command: netfilter-persistent save
  roles:
    - role: generic_docker_systemd
  tags:
    - never
    - influxdb
    - test

## Grafana

- name: Deploy grafana in docker
  hosts: all
  become: true
  gather_facts: false
  vars:
    create_volume: false
    service_name: grafana
    docker_image: "{{ grafana_docker_image }}"
    enable_db: false
    create_network: true
    docker_command: |
      /usr/bin/docker run --rm --name "{{ service_name }}" \
      --user 1000:1000 \
      -v "{{ grafana_directory.conf }}":/etc/grafana \
      -v "{{ grafana_directory.data }}":/var/lib/grafana \
      -v '/etc/localtime:/etc/localtime:ro' \
      -p "{{ grafana_internal_web_port }}:3000" \
      -e "GF_RENDERING_SERVER_URL=http://grafana-image-renderer:8081/render" \
      -e "GF_RENDERING_CALLBACK_URL=http://grafana:3000/" \
      --network {{ service_name }} \
      "{{ docker_image }}"
  pre_tasks:
    - name: Create grafana directories
      file:
        path: "{{ item.value }}"
        state: directory
        owner: "{{ user_uid_1000 }}"
        group: "{{ group_gid_1000 }}"
        mode: 0700
      with_dict: "{{ grafana_directory }}"
    - name: Configure grafana
      template:
        src: grafana.ini.j2
        dest: "{{ grafana_directory.conf }}/grafana.ini"
        force: "{{ override | default('no') }}"
        owner: "{{ user_uid_1000 }}"
        group: "{{ group_gid_1000 }}"
        mode: 0600
  roles:
    - role: generic_docker_systemd
  tags:
    - never
    - grafana
    - test

- name: Deploy grafana image renderer in docker
  hosts: all
  become: true
  gather_facts: false
  vars:
    create_volume: false
    service_name: grafana-image-renderer
    docker_image: "{{ grafana_image_renderer_docker_image }}"
    enable_db: false
    docker_command: |
      /usr/bin/docker run --rm --name "{{ service_name }}" \
      --user 1000:1000 \
      -v '/etc/localtime:/etc/localtime:ro' \
      -e 'ENABLE_METRICS=true' \
      --network grafana \
      "{{ docker_image }}"
  roles:
    - role: generic_docker_systemd
  tags:
    - never
    - grafana
    - test

- name: Get grafana subdomain Let's Encrypt certificate
  hosts: all
  become: true
  gather_facts: false
  vars:
    domain: "{{ grafana_domain }}"
    letsencrypt_renew_hook: /usr/sbin/service nginx reload
  roles:
    - role: letsencrypt_request
      tags: letsecrypt_request
  tags:
    - never
    - grafana
    - test

- name: Configure nginx proxy for grafana
  hosts: all
  become: true
  gather_facts: false
  vars:
    domain: "{{ grafana_domain }}"
    binded_port: "{{ grafana_internal_web_port }}"
  roles:
    - role: add_nginx_proxy_conf
      tags: proxy
  tags:
    - never
    - grafana
    - test

## RStudio

- name: Deploy rstudio in docker
  hosts: all
  become: true
  gather_facts: false
  vars:
    create_volume: false
    service_name: rstudio
    docker_image: "{{ rstudio_docker_image }}"
    enable_db: false
    docker_command: |
      /usr/bin/docker run --rm --name "{{ service_name }}" \
      --cpus {{ rstudio_cpus_limit }} \
      --memory {{ rstudio_memory_limit }} \
      -v "{{ rstudio_directory.data }}:/home/{{ rstudio_user }}" \
      -v /etc/localtime:/etc/localtime:ro \
      -p "{{ rstudio_internal_web_port }}:8787" \
      -e "PASSWORD={{ rstudio_pass }}" \
      -e "USER={{ rstudio_user }}" \
      "{{ docker_image }}"
  pre_tasks:
    - name: Create rstudio directories
      file:
        path: "{{ item.value }}"
        state: directory
        owner: "{{ user_uid_1000 }}"
        group: "{{ group_gid_1000 }}"
        mode: 0700
      with_dict: "{{ rstudio_directory }}"
  roles:
    - role: generic_docker_systemd
  tags:
    - never
    - rstudio
    - test

- name: Get rstudio subdomain Let's Encrypt certificate
  hosts: all
  become: true
  gather_facts: false
  vars:
    domain: "{{ rstudio_domain }}"
    letsencrypt_renew_hook: /usr/sbin/service nginx reload
  roles:
    - role: letsencrypt_request
      tags: letsecrypt_request
  tags:
    - never
    - rstudio
    - test

- name: Configure nginx proxy for rstudio
  hosts: all
  become: true
  gather_facts: false
  vars:
    domain: "{{ rstudio_domain }}"
    binded_port: "{{ rstudio_internal_web_port }}"
  roles:
    - role: add_nginx_proxy_conf
      tags: proxy
  tags:
    - never
    - rstudio
    - test

## Jellyfin

- name: Deploy jellyfin in docker
  hosts: all
  become: true
  gather_facts: false
  vars:
    create_volume: false
    create_network: true
    enable_db: false
    service_name: jellyfin
    docker_image: "{{ jellyfin_docker_image }}"
    docker_command: |
      /usr/bin/docker run --rm --name "{{ service_name }}" \
      -v "{{ jellyfin_directory.cache }}":/cache \
      -v "{{ jellyfin_directory.config }}":/config \
      -v "{{ jellyfin_directory.media }}":/media \
      -v '/etc/localtime:/etc/localtime:ro' \
      -p "{{ jellyfin_internal_web_port }}:8096" \
      --network "{{ service_name }}" \
      {% if jellyfin_nvidia_runtime %}
      --runtime=nvidia \
      -e NVIDIA_VISIBLE_DEVICES=all \
      -e NVIDIA_DRIVER_CAPABILITIES="compute,video,utility" \
      {% endif %}
      "{{ docker_image }}"
  pre_tasks:
    - name: Create jellyfin directories
      file:
        path: "{{ item.value }}"
        state: directory
        owner: "{{ user_uid_1000 }}"
        group: "{{ group_gid_1000 }}"
        mode: 0700
      with_dict: "{{ jellyfin_directory }}"
  roles:
    - role: generic_docker_systemd
  tags:
    - never
    - jellyfin
    - test

- name: Get jellyfin subdomain Let's Encrypt certificate
  hosts: all
  become: true
  gather_facts: false
  vars:
    domain: "{{ jellyfin_domain }}"
    letsencrypt_renew_hook: /usr/sbin/service nginx reload
  roles:
    - role: letsencrypt_request
      tags: letsecrypt_request
  tags:
    - never
    - jellyfin
    - test

- name: Configure nginx proxy for jellyfin
  hosts: all
  become: true
  gather_facts: false
  vars:
    domain: "{{ jellyfin_domain }}"
    binded_port: "{{ jellyfin_internal_web_port }}"
    external_port: 443
    ssl_certificate: "/etc/letsencrypt/live/{{ domain }}/fullchain.pem"
    ssl_certificate_key: "/etc/letsencrypt/live/{{ domain }}/privkey.pem"
    template_path: jellyfin_nginx.conf.j2
  roles:
    - role: add_nginx_proxy_conf
      tags: proxy
  tags:
    - never
    - jellyfin
    - test

## Portainer

- name: Deploy portainer in docker
  hosts: all
  become: true
  gather_facts: false
  vars:
    create_volume: false
    enable_db: false
    service_name: portainer
    docker_image: "{{ portainer_docker_image }}"
    docker_command: |
      /usr/bin/docker run --rm --name "{{ service_name }}" \
      -v /var/run/docker.sock:/var/run/docker.sock \
      -v "{{ portainer_directory.data }}":/data \
      -v '/etc/localtime:/etc/localtime:ro' \
      -p "{{ portainer_internal_web_port }}:9000" \
      "{{ docker_image }}"
  pre_tasks:
    - name: Create portainer directories
      file:
        path: "{{ item.value }}"
        state: directory
        owner: "{{ user_uid_1000 }}"
        group: "{{ group_gid_1000 }}"
        mode: 0700
      with_dict: "{{ portainer_directory }}"
  roles:
    - role: generic_docker_systemd
  tags:
    - never
    - portainer
    - test

- name: Get portainer subdomain Let's Encrypt certificate
  hosts: all
  become: true
  gather_facts: false
  vars:
    domain: "{{ portainer_domain }}"
    letsencrypt_renew_hook: /usr/sbin/service nginx reload
  roles:
    - role: letsencrypt_request
      tags: letsecrypt_request
  tags:
    - never
    - portainer
    - test

- name: Configure nginx proxy for portainer
  hosts: all
  become: true
  gather_facts: false
  vars:
    domain: "{{ portainer_domain }}"
    binded_port: "{{ portainer_internal_web_port }}"
    proxy_conf: |
      proxy_pass        http://127.0.0.1:{{ binded_port }};
      proxy_set_header Host $host;
      proxy_set_header X-Real-IP $remote_addr;
      proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
      proxy_set_header X-Forwarded-Proto $scheme;
      proxy_set_header Connection $http_connection;
      proxy_set_header Upgrade $http_upgrade;
      proxy_set_header Connection "upgrade";
  roles:
    - role: add_nginx_proxy_conf
      tags: proxy
  tags:
    - never
    - portainer
    - test

## Anki Sync Server

- name: Deploy anki in docker
  hosts: all
  become: true
  gather_facts: false
  vars:
    create_volume: false
    enable_db: false
    service_name: anki
    docker_image: "{{ anki_docker_image }}"
    docker_command: |
      /usr/bin/docker run --rm --name "{{ service_name }}" \
      -v "{{ anki_directory.data }}":/app/data \
      -v '/etc/localtime:/etc/localtime:ro' \
      --user 1000:1000 \
      -p "{{ anki_internal_web_port }}:27701" \
      "{{ docker_image }}"
  pre_tasks:
    - name: Create anki directories
      file:
        path: "{{ item.value }}"
        state: directory
        owner: "{{ user_uid_1000 }}"
        group: "{{ group_gid_1000 }}"
        mode: 0700
      with_dict: "{{ anki_directory }}"
  roles:
    - role: generic_docker_systemd
  tags:
    - never
    - anki
    - test

- name: Get anki subdomain Let's Encrypt certificate
  hosts: all
  become: true
  gather_facts: false
  vars:
    domain: "{{ anki_domain }}"
    letsencrypt_renew_hook: /usr/sbin/service nginx reload
  roles:
    - role: letsencrypt_request
      tags: letsecrypt_request
  tags:
    - never
    - anki
    - test

- name: Configure nginx proxy for anki
  hosts: all
  become: true
  gather_facts: false
  vars:
    domain: "{{ anki_domain }}"
    binded_port: "{{ anki_internal_web_port }}"
  roles:
    - role: add_nginx_proxy_conf
      tags: proxy
  tags:
    - never
    - anki
    - test

## Moodle

- name: Deploy moodle in docker
  hosts: all
  become: true
  gather_facts: false
  vars:
    create_volume: false
    service_name: moodle
    docker_image: "{{ moodle_docker_image }}"
    docker_db_image: "{{ moodle_db_image }}"
    create_network: true
    service_db_name: "{{ service_name }}-db"
    db_type: postgres
    docker_service_directory_db: "{{ moodle_directory.db }}"
    db_user_pass: "{{ moodle_db_user_pass }}"
    db_config_port: 5432
    db_name: "{{ moodle_db_name }}"
    db_user: "{{ moodle_db_user }}"
    docker_command: |
      /usr/bin/docker run --rm --name "{{ service_name }}" \
      -v "{{ moodle_directory.html }}":/var/www/html \
      -v "{{ moodle_directory.data }}":/var/www/moodledata \
      -v '/etc/localtime:/etc/localtime:ro' \
      -p "{{ moodle_internal_web_port }}:80" \
      --network "{{ service_name }}" \
      "{{ docker_image }}"
  pre_tasks:
    - name: Create moodle directories 750 uid 33
      file:
        path: "{{ item }}"
        state: directory
        owner: "{{ user_uid_33 }}"
        group: "{{ group_gid_33 }}"
        mode: 0750
      with_items:
        - "{{ moodle_directory.data }}"
        - "{{ moodle_directory.html }}"
    - name: Create moodle directories 700 uid 1000
      file:
        path: "{{ item }}"
        state: directory
        owner: "{{ user_uid_1000 }}"
        group: "{{ group_gid_1000 }}"
        mode: 0700
      with_items:
        - "{{ moodle_directory.db }}"
    - name: Clone moodle repo
      git:
        repo: "{{ moodle_git_repo }}"
        dest: "{{ moodle_directory.html }}"
        version: "{{ moodle_git_repo_version }}"
        # - name: Configure moodle
        #   template:
        #     src: moodle-config.php.j2
        #     dest: "{{ moodle_directory.html }}/config.php"
        #     force: "{{ override | default('no') }}"
        #     owner: "{{ user_uid_33 }}"
        #     group: "{{ group_gid_33 }}"
        #     mode: 0640
  roles:
    - role: generic_docker_systemd
  tags:
    - never
    - moodle
    - test

- name: Get moodle subdomain Let's Encrypt certificate
  hosts: all
  become: true
  gather_facts: false
  vars:
    domain: "{{ moodle_domain }}"
    letsencrypt_renew_hook: /usr/sbin/service nginx reload
  roles:
    - role: letsencrypt_request
      tags: letsecrypt_request
  tags:
    - never
    - moodle
    - test

- name: Configure nginx proxy for moodle
  hosts: all
  become: true
  gather_facts: false
  vars:
    domain: "{{ moodle_domain }}"
    binded_port: "{{ moodle_internal_web_port }}"
  roles:
    - role: add_nginx_proxy_conf
      tags: proxy
  tags:
    - never
    - moodle
    - test

## JupyterHub

- name: Deploy jupyterhub in docker
  hosts: all
  become: true
  gather_facts: false
  vars:
    create_volume: false
    enable_db: false
    create_network: true
    service_name: jupyterhub
    docker_image: "{{ jupyterhub_docker_image }}"
    docker_command: |
      /usr/bin/docker run --rm --name "{{ service_name }}" \
      -v /var/run/docker.sock:/var/run/docker.sock \
      -v "{{ jupyterhub_directory.data }}/jupyterhub_config.py:/srv/jupyterhub/jupyterhub_config.py:ro" \
      -v "{{ jupyterhub_directory.data }}/cull_idle_servers.py:/srv/jupyterhub/cull_idle_servers.py:ro" \
      -v "{{ jupyterhub_directory.user_data }}:/home" \
      -v '/etc/localtime:/etc/localtime:ro' \
      -p "{{ jupyterhub_internal_web_port }}:8000" \
      --network "{{ service_name }}" \
      "{{ docker_image }}"
  pre_tasks:
    - name: Create jupyterhub directories
      file:
        path: "{{ item.value }}"
        state: directory
        owner: "{{ user_uid_1000 }}"
        group: "{{ group_gid_1000 }}"
        mode: 0700
      with_dict: "{{ jupyterhub_directory }}"
    - name: Copy jupyterhub configuration template
      template:
        src: jupyterhub_config.py.j2
        dest: "{{ jupyterhub_directory.data }}/jupyterhub_config.py"
        force: "{{ override | default('no') }}"
        owner: "{{ user_uid_1000 }}"
        group: "{{ group_gid_1000 }}"
        mode: 0700
  post_tasks:
    - name: Pull jupyter Docker image
      docker_image:
        name: "{{ jupyterhub_jupyter_docker_image }}"
        source: pull
  roles:
    - role: generic_docker_systemd
  tags:
    - never
    - jupyterhub
    - test

- name: Get jupyterhub subdomain Let's Encrypt certificate
  hosts: all
  become: true
  gather_facts: false
  vars:
    domain: "{{ jupyterhub_domain }}"
    letsencrypt_renew_hook: /usr/sbin/service nginx reload
  roles:
    - role: letsencrypt_request
      tags: letsecrypt_request
  tags:
    - never
    - jupyterhub
    - test

- name: Configure nginx proxy for jupyterhub
  hosts: all
  become: true
  gather_facts: false
  vars:
    domain: "{{ jupyterhub_domain }}"
    binded_port: "{{ jupyterhub_internal_web_port }}"
    proxy_conf: |
      proxy_pass        http://127.0.0.1:{{ binded_port }};
      proxy_http_version 1.1;
      proxy_set_header X-Real-IP $remote_addr;
      proxy_set_header Host $host;
      proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

      # websocket headers
      proxy_set_header Upgrade $http_upgrade;
      proxy_set_header Connection "upgrade";
  roles:
    - role: add_nginx_proxy_conf
      tags: proxy
  tags:
    - never
    - jupyterhub
    - test

## Jackett

- name: Deploy jackett in docker
  hosts: all
  become: true
  gather_facts: false
  vars:
    create_volume: false
    enable_db: false
    create_network: true
    service_name: jackett
    docker_image: "{{ jackett_docker_image }}"
    docker_command: |
      /usr/bin/docker run --rm --name "{{ service_name }}" \
      -v /etc/localtime:/etc/localtime:ro \
      -e "PGID=1000" -e "PUID=1000" \
      -v "{{ jackett_directory.conf }}:/config" \
      -p "{{ jackett_internal_web_port }}:9117" \
      --network "jellyfin" \
      "{{ docker_image }}"
  pre_tasks:
    - name: Create jackett directories
      file:
        path: "{{ item.value }}"
        state: directory
        owner: "{{ user_uid_1000 }}"
        group: "{{ group_gid_1000 }}"
        mode: 0700
      with_dict: "{{ jackett_directory }}"
  roles:
    - role: generic_docker_systemd
  tags:
    - never
    - jackett
    - test

- name: Get jackett subdomain Let's Encrypt certificate
  hosts: all
  become: true
  gather_facts: false
  vars:
    domain: "{{ jackett_domain }}"
    letsencrypt_renew_hook: /usr/sbin/service nginx reload
  roles:
    - role: letsencrypt_request
      tags: letsecrypt_request
  tags:
    - never
    - jackett
    - test

- name: Configure nginx proxy for jackett
  hosts: all
  become: true
  gather_facts: false
  vars:
    domain: "{{ jackett_domain }}"
    binded_port: "{{ jackett_internal_web_port }}"
  roles:
    - role: add_nginx_proxy_conf
      tags: proxy
  tags:
    - never
    - jackett
    - test

## Sonarr

- name: Deploy sonarr in docker
  hosts: all
  become: true
  gather_facts: false
  vars:
    create_volume: false
    enable_db: false
    create_network: true
    service_name: sonarr
    docker_image: "{{ sonarr_docker_image }}"
    docker_command: |
      /usr/bin/docker run --rm --name "{{ service_name }}" \
      -v /etc/localtime:/etc/localtime:ro \
      -e "PGID=1000" -e "PUID=1000" \
      -v "{{ sonarr_directory.conf }}:/config" \
      -v "{{ sonarr_directory.tvseries }}:/tv" \
      -v "{{ sonarr_directory.downloadclient }}:/downloads" \
      -p "{{ sonarr_internal_web_port }}:8989" \
      --network "jellyfin" \
      "{{ docker_image }}"
  pre_tasks:
    - name: Create sonarr directories
      file:
        path: "{{ item.value }}"
        state: directory
        owner: "{{ user_uid_1000 }}"
        group: "{{ group_gid_1000 }}"
        mode: 0700
      with_dict: "{{ sonarr_directory }}"
  roles:
    - role: generic_docker_systemd
  tags:
    - never
    - sonarr
    - test

- name: Get sonarr subdomain Let's Encrypt certificate
  hosts: all
  become: true
  gather_facts: false
  vars:
    domain: "{{ sonarr_domain }}"
    letsencrypt_renew_hook: /usr/sbin/service nginx reload
  roles:
    - role: letsencrypt_request
      tags: letsecrypt_request
  tags:
    - never
    - sonarr
    - test

- name: Configure nginx proxy for sonarr
  hosts: all
  become: true
  gather_facts: false
  vars:
    domain: "{{ sonarr_domain }}"
    binded_port: "{{ sonarr_internal_web_port }}"
  roles:
    - role: add_nginx_proxy_conf
      tags: proxy
  tags:
    - never
    - sonarr
    - test

## Radarr

- name: Deploy radarr in docker
  hosts: all
  become: true
  gather_facts: false
  vars:
    create_volume: false
    enable_db: false
    create_network: true
    service_name: radarr
    docker_image: "{{ radarr_docker_image }}"
    docker_command: |
      /usr/bin/docker run --rm --name "{{ service_name }}" \
      -v /etc/localtime:/etc/localtime:ro \
      -e "PGID=1000" -e "PUID=1000" \
      -v "{{ radarr_directory.conf }}:/config" \
      -v "{{ radarr_directory.movies }}:/movies" \
      -v "{{ radarr_directory.downloadclient }}:/downloads" \
      -p "{{ radarr_internal_web_port }}:7878" \
      --network "jellyfin" \
      "{{ docker_image }}"
  pre_tasks:
    - name: Create radarr directories
      file:
        path: "{{ item.value }}"
        state: directory
        owner: "{{ user_uid_1000 }}"
        group: "{{ group_gid_1000 }}"
        mode: 0700
      with_dict: "{{ radarr_directory }}"
  roles:
    - role: generic_docker_systemd
  tags:
    - never
    - radarr
    - test

- name: Get radarr subdomain let's encrypt certificate
  hosts: all
  become: true
  gather_facts: false
  vars:
    domain: "{{ radarr_domain }}"
    letsencrypt_renew_hook: /usr/sbin/service nginx reload
  roles:
    - role: letsencrypt_request
      tags: letsecrypt_request
  tags:
    - never
    - radarr
    - test

- name: Configure nginx proxy for radarr
  hosts: all
  become: true
  gather_facts: false
  vars:
    domain: "{{ radarr_domain }}"
    binded_port: "{{ radarr_internal_web_port }}"
  roles:
    - role: add_nginx_proxy_conf
      tags: proxy
  tags:
    - never
    - radarr
    - test

## Lidarr

- name: Deploy lidarr in docker
  hosts: all
  become: true
  gather_facts: false
  vars:
    create_volume: false
    enable_db: false
    create_network: true
    service_name: lidarr
    docker_image: "{{ lidarr_docker_image }}"
    docker_command: |
      /usr/bin/docker run --rm --name "{{ service_name }}" \
      -v /etc/localtime:/etc/localtime:ro \
      -e "PGID=1000" -e "PUID=1000" \
      -v "{{ lidarr_directory.conf }}:/config" \
      -v "{{ lidarr_directory.music }}:/music" \
      -v "{{ lidarr_directory.downloadclient }}:/downloads" \
      -p "{{ lidarr_internal_web_port }}:8686" \
      --network "jellyfin" \
      "{{ docker_image }}"
  pre_tasks:
    - name: Create lidarr directories
      file:
        path: "{{ item.value }}"
        state: directory
        owner: "{{ user_uid_1000 }}"
        group: "{{ group_gid_1000 }}"
        mode: 0700
      with_dict: "{{ lidarr_directory }}"
  roles:
    - role: generic_docker_systemd
  tags:
    - never
    - lidarr
    - test

- name: Get lidarr subdomain Let's Encrypt certificate
  hosts: all
  become: true
  gather_facts: false
  vars:
    domain: "{{ lidarr_domain }}"
    letsencrypt_renew_hook: /usr/sbin/service nginx reload
  roles:
    - role: letsencrypt_request
      tags: letsecrypt_request
  tags:
    - never
    - lidarr
    - test

- name: Configure nginx proxy for lidarr
  hosts: all
  become: true
  gather_facts: false
  vars:
    domain: "{{ lidarr_domain }}"
    binded_port: "{{ lidarr_internal_web_port }}"
  roles:
    - role: add_nginx_proxy_conf
      tags: proxy
  tags:
    - never
    - lidarr
    - test

## Bazarr

- name: Deploy bazarr in docker
  hosts: all
  become: true
  gather_facts: false
  vars:
    create_volume: false
    enable_db: false
    create_network: true
    service_name: bazarr
    docker_image: "{{ bazarr_docker_image }}"
    docker_command: |
      /usr/bin/docker run --rm --name "{{ service_name }}" \
      -v /etc/localtime:/etc/localtime:ro \
      -e "PGID=1000" -e "PUID=1000" \
      -v "{{ bazarr_directory.conf }}:/config" \
      -v "{{ bazarr_directory.tv }}:/tv" \
      -v "{{ bazarr_directory.movies }}:/movies" \
      -p "{{ bazarr_internal_web_port }}:6767" \
      --network "jellyfin" \
      "{{ docker_image }}"
  pre_tasks:
    - name: Create bazarr directories
      file:
        path: "{{ item.value }}"
        state: directory
        owner: "{{ user_uid_1000 }}"
        group: "{{ group_gid_1000 }}"
        mode: 0700
      with_dict: "{{ bazarr_directory }}"
  roles:
    - role: generic_docker_systemd
  tags:
    - never
    - bazarr
    - test

- name: Get bazarr subdomain Let's Encrypt certificate
  hosts: all
  become: true
  gather_facts: false
  vars:
    domain: "{{ bazarr_domain }}"
    letsencrypt_renew_hook: /usr/sbin/service nginx reload
  roles:
    - role: letsencrypt_request
      tags: letsecrypt_request
  tags:
    - never
    - bazarr
    - test

- name: Configure nginx proxy for bazarr
  hosts: all
  become: true
  gather_facts: false
  vars:
    domain: "{{ bazarr_domain }}"
    binded_port: "{{ bazarr_internal_web_port }}"
  roles:
    - role: add_nginx_proxy_conf
      tags: proxy
  tags:
    - never
    - bazarr
    - test

## Ombi

- name: Deploy ombi in docker
  hosts: all
  become: true
  gather_facts: false
  vars:
    create_volume: false
    enable_db: false
    create_network: true
    service_name: ombi
    docker_image: "{{ ombi_docker_image }}"
    docker_command: |
      /usr/bin/docker run --rm --name "{{ service_name }}" \
      -v /etc/localtime:/etc/localtime:ro \
      -e "PGID=1000" -e "PUID=1000" \
      -v "{{ ombi_directory.conf }}:/config" \
      -p "{{ ombi_internal_web_port }}:3579" \
      --network "jellyfin" \
      "{{ docker_image }}"
  pre_tasks:
    - name: Create ombi directories
      file:
        path: "{{ item.value }}"
        state: directory
        owner: "{{ user_uid_1000 }}"
        group: "{{ group_gid_1000 }}"
        mode: 0700
      with_dict: "{{ ombi_directory }}"
  roles:
    - role: generic_docker_systemd
  tags:
    - never
    - ombi
    - test

- name: Get ombi subdomain Let's Encrypt certificate
  hosts: all
  become: true
  gather_facts: false
  vars:
    domain: "{{ ombi_domain }}"
    letsencrypt_renew_hook: /usr/sbin/service nginx reload
  roles:
    - role: letsencrypt_request
      tags: letsecrypt_request
  tags:
    - never
    - ombi
    - test

- name: Configure nginx proxy for ombi
  hosts: all
  become: true
  gather_facts: false
  vars:
    domain: "{{ ombi_domain }}"
    binded_port: "{{ ombi_internal_web_port }}"
  roles:
    - role: add_nginx_proxy_conf
      tags: proxy
  tags:
    - never
    - ombi
    - test

## ShareLaTeX

- name: Deploy sharelatex in docker
  hosts: all
  become: true
  gather_facts: false
  vars:
    service_name: sharelatex
    docker_image: "{{ sharelatex_docker_image }}"
    docker_db_image: "{{ sharelatex_db_image }}"
    enable_redis: true
    docker_redis_image: "{{ sharelatex_redis_image }}"
    create_network: true
    db_type: mongo
    docker_service_directory_db: "{{ sharelatex_directory.db }}"
    db_user_pass: "{{ sharelatex_db_user_pass }}"
    db_config_port: "{{ default_db_config_port }}"
    db_name: "{{ sharelatex_db_name }}"
    db_user: "{{ sharelatex_db_user }}"
    docker_service_directory_redis: "{{ sharelatex_directory.redis }}"
    docker_command: |
      /usr/bin/docker run --rm --name "{{ service_name }}" \
      -p "{{ sharelatex_web_port }}:80" \
      -v "{{ sharelatex_directory_www_data.data }}:/var/lib/sharelatex" \
      -e "SHARELATEX_MONGO_URL=mongodb://{{ sharelatex_db_user }}:{{ sharelatex_db_user_pass }}@{{ sharelatex_db_service_name }}:27017/{{ sharelatex_db_name }}" \
      -e "SHARELATEX_APP_NAME={{ sharelatex_app_name }}" \
      -e "SHARELATEX_SITE_URL=https://{{ sharelatex_domain }}" \
      -e "SHARELATEX_REDIS_HOST={{ service_name }}-redis" \
      -e "REDIS_HOST={{ service_name }}-redis" \
      -e "ENABLED_LINKED_FILE_TYPES=url,project_file" \
      -e "ENABLE_CONVERSIONS=true" \
      -e "EMAIL_CONFIRMATION_DISABLED=true" \
      -e "SHARELATEX_SECURE_COOKIE=true" \
      -e "SHARELATEX_BEHIND_PROXY=true" \
      -v '/etc/localtime:/etc/localtime:ro' \
      --network "{{ sharelatex_network_name }}" \
      "{{ docker_image }}"
  pre_tasks:
    - name: Create sharelatex directories 750 www-data
      become: true
      file:
        path: "{{ item.value }}"
        state: directory
        owner: "{{ user_uid_33 }}"
        group: "{{ group_gid_33 }}"
        mode: 0750
      with_dict: "{{ sharelatex_directory_www_data }}"
    - name: Create sharelatex directories 700
      file:
        path: "{{ item.value }}"
        state: directory
        mode: 0700
        owner: "{{ user_uid_1000 }}"
        group: "{{ group_gid_1000 }}"
      with_dict: "{{ sharelatex_directory }}"
  roles:
    - role: generic_docker_systemd
  tags:
    - never
    - sharelatex
    - test

- name: Get sharelatex subdomain Let's Encrypt certificate
  hosts: all
  become: true
  gather_facts: false
  vars:
    domain: "{{ sharelatex_domain }}"
    letsencrypt_renew_hook: /usr/sbin/service nginx reload
  roles:
    - role: letsencrypt_request
      tags: letsecrypt_request
  tags:
    - never
    - sharelatex
    - test

- name: Configure nginx proxy for sharelatex
  hosts: all
  become: true
  gather_facts: false
  vars:
    domain: "{{ sharelatex_domain }}"
    binded_port: "{{ sharelatex_web_port }}"
    proxy_conf: |
      proxy_pass        http://127.0.0.1:{{ binded_port }};
      proxy_set_header X-Forwarded-Proto $scheme;
      proxy_http_version 1.1;
      proxy_set_header Upgrade $http_upgrade;
      proxy_set_header Connection "upgrade";
      proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
      proxy_read_timeout 3m;
      proxy_send_timeout 3m;
  roles:
    - role: add_nginx_proxy_conf
      tags: proxy
  tags:
    - never
    - sharelatex
    - test

## TiddlyWiki

- name: Deploy tiddlywiki in docker
  hosts: all
  become: true
  gather_facts: false
  vars:
    service_name: tiddlywiki
    docker_image: "{{ tiddlywiki_docker_image }}"
    enable_db: false
    docker_command: |
      /usr/bin/docker run --rm --name "{{ service_name }}" \
      --user 1000:1000 \
      -v "{{ tiddlywiki_directory.data }}:/var/lib/tiddlywiki" \
      -e "USERNAME={{ tiddlywiki_user }}" \
      -e "PASSWORD={{ tiddlywiki_pass }}" \
      -v '/etc/localtime:/etc/localtime:ro' \
      -p "{{ tiddlywiki_web_port }}:8080" \
      "{{ docker_image }}"
  pre_tasks:
    - name: Create tiddlywiki directories
      file:
        path: "{{ item.value }}"
        state: directory
        mode: 0700
        owner: "{{ user_uid_1000 }}"
        group: "{{ group_gid_1000 }}"
      with_dict: "{{ tiddlywiki_directory }}"
  roles:
    - role: generic_docker_systemd
  tags:
    - never
    - tiddlywiki
    - test

- name: Get tiddlywiki subdomain Let's Encrypt certificate
  hosts: all
  become: true
  gather_facts: false
  vars:
    domain: "{{ tiddlywiki_domain }}"
    letsencrypt_renew_hook: /usr/sbin/service nginx reload
  roles:
    - role: letsencrypt_request
      tags: letsecrypt_request
  tags:
    - never
    - tiddlywiki
    - test

- name: Configure nginx proxy for tiddlywiki
  hosts: all
  become: true
  gather_facts: false
  vars:
    domain: "{{ tiddlywiki_domain }}"
    binded_port: "{{ tiddlywiki_web_port }}"
  roles:
    - role: add_nginx_proxy_conf
      tags: proxy
  tags:
    - never
    - tiddlywiki
    - test

## Pi-hole

- name: Deploy pihole in docker
  hosts: all
  become: true
  gather_facts: false
  vars:
    service_name: pihole
    docker_image: "{{ pihole_docker_image }}"
    create_volume: false
    enable_db: false
    docker_command: |
      /usr/bin/docker run --rm --name "{{ service_name }}" \
      -v "{{ pihole_directory.conf }}:/etc/pihole/" \
      -v "{{ pihole_directory.dnsmasq }}:/etc/dnsmasq.d/" \
      -e "VIRTUAL_HOST={{ pihole_domain }}" \
      -e "WEBPASSWORD={{ pihole_pass }}" \
      -e "DNS1={{ pihole_dns1 }}" \
      -e "DNS2={{ pihole_dns2 }}" \
      -e "ServerIP={{ pihole_lan_ip }}" \
      -e "DNSMASQ_USER=root" \
      -v '/etc/localtime:/etc/localtime:ro' \
      -p "{{ pihole_web_port }}:80" \
      -p "53:53/tcp" \
      -p "53:53/udp" \
      -p "67:67/udp" \
      "{{ docker_image }}"
  pre_tasks:
    - name: Gather facts
      setup:
        filter: ansible_*
    - name: Create pihole directories 999:999
      file:
        path: "{{ pihole_directory.conf }}"
        state: directory
        mode: 0771
        owner: "{{ user_uid_999 }}"
        group: "{{ group_gid_999 }}"
    - name: Create pihole directories
      file:
        path: "{{ pihole_directory.dnsmasq }}"
        state: directory
        mode: 0700
        owner: "{{ user_uid_1000 }}"
        group: "{{ group_gid_1000 }}"
  post_tasks:
    - name: Add iptables rules for pihole 53 tcp
      iptables:
        chain: INPUT
        protocol: tcp
        ctstate: NEW
        match: tcp
        destination_port: 53
        jump: ACCEPT
        comment: pihole
      notify: save iptables
      tags: iptables
    - name: Add iptables rules for pihole 53 udp
      iptables:
        chain: INPUT
        protocol: udp
        ctstate: NEW
        match: udp
        destination_port: 53
        jump: ACCEPT
        comment: pihole
      notify: save iptables
      tags: iptables
    - name: Add iptables rules for pihole 67 udp
      iptables:
        chain: INPUT
        protocol: udp
        ctstate: NEW
        match: udp
        destination_port: 67
        jump: ACCEPT
        comment: pihole
      notify: save iptables
      tags: iptables
  handlers:
    - name: save iptables
      command: netfilter-persistent save
  roles:
    - role: generic_docker_systemd
  tags:
    - never
    - pihole
    - test

- name: Get pihole subdomain Let's Encrypt certificate
  hosts: all
  become: true
  gather_facts: false
  vars:
    domain: "{{ pihole_domain }}"
    letsencrypt_renew_hook: /usr/sbin/service nginx reload
  roles:
    - role: letsencrypt_request
      tags: letsecrypt_request
  tags:
    - never
    - pihole
    - test

- name: Configure nginx proxy for pihole
  hosts: all
  become: true
  gather_facts: false
  vars:
    domain: "{{ pihole_domain }}"
    binded_port: "{{ pihole_web_port }}"
  roles:
    - role: add_nginx_proxy_conf
      tags: proxy
  tags:
    - never
    - pihole
    - test

## Grocy

- name: Deploy grocy in docker
  hosts: all
  become: true
  gather_facts: false
  vars:
    service_name: grocy
    docker_image: "{{ grocy_docker_image }}"
    create_volume: false
    enable_db: false
    docker_command: |
      /usr/bin/docker run --rm --name "{{ service_name }}" \
      -v "{{ grocy_directory.conf }}:/config" \
      -v "/etc/localtime:/etc/localtime:ro" \
      -e "PUID=1000" \
      -e "PGID=1000" \
      -p "{{ grocy_web_port }}:80" \
      "{{ docker_image }}"
  pre_tasks:
    - name: Create grocy directories
      file:
        path: "{{ item.value }}"
        state: directory
        owner: "{{ user_uid_1000 }}"
        group: "{{ group_gid_1000 }}"
        mode: 0700
      with_dict: "{{ grocy_directory }}"
  roles:
    - role: generic_docker_systemd
  tags:
    - never
    - grocy
    - test

- name: Get grocy subdomain Let's Encrypt certificate
  hosts: all
  become: true
  gather_facts: false
  vars:
    domain: "{{ grocy_domain }}"
    letsencrypt_renew_hook: /usr/sbin/service nginx reload
  roles:
    - role: letsencrypt_request
      tags: letsecrypt_request
  tags:
    - never
    - grocy
    - test

- name: Configure nginx proxy for grocy
  hosts: all
  become: true
  gather_facts: false
  vars:
    domain: "{{ grocy_domain }}"
    binded_port: "{{ grocy_web_port }}"
  roles:
    - role: add_nginx_proxy_conf
      tags: proxy
  tags:
    - never
    - grocy
    - test

# Keep Home Assistant last, otherwise it shuts down if not configured before
# the tests.
## Home Assistant

- name: Deploy home_assistant in docker
  hosts: all
  become: true
  gather_facts: false
  vars:
    create_volume: false
    service_name: home_assistant
    docker_image: "{{ home_assistant_docker_image }}"
    enable_db: false
    docker_command: |
      /usr/bin/docker run --rm --name "{{ service_name }}" \
      --user 1000:1000 \
      -v "{{ home_assistant_directory.conf }}":/config \
      -v /etc/localtime:/etc/localtime:ro \
      --net=host \
      "{{ docker_image }}"
  pre_tasks:
    - name: Create home_assistant directories
      file:
        path: "{{ item.value }}"
        state: directory
        owner: "{{ user_uid_1000 }}"
        group: "{{ group_gid_1000 }}"
        mode: 0700
      with_dict: "{{ home_assistant_directory }}"
    - name: Touch home_assistant extra configuration files
      file:
        path: "{{ home_assistant_directory.conf }}/{{ item }}"
        state: touch
        modification_time: preserve
        access_time: preserve
      with_items:
        - groups.yaml
        - scripts.yaml
    - name: Copy empty automations file
      copy:
        src: home_assistant_automations.yaml
        dest: "{{ home_assistant_directory.conf }}/automations.yaml"
        force: "{{ override | default('no') }}"
    - name: Configure home_assistant
      template:
        src: home_assistant.yaml.j2
        dest: "{{ home_assistant_directory.conf }}/configuration.yaml"
        force: "{{ override | default('no') }}"
        owner: "{{ user_uid_1000 }}"
        group: "{{ group_gid_1000 }}"
        mode: 0600
  roles:
    - role: generic_docker_systemd
  tags:
    - never
    - home_assistant
    - test

- name: Get home_assistant subdomain Let's Encrypt certificate
  hosts: all
  become: true
  gather_facts: false
  vars:
    domain: "{{ home_assistant_domain }}"
    letsencrypt_renew_hook: /usr/sbin/service nginx reload
  roles:
    - role: letsencrypt_request
      tags: letsecrypt_request
  tags:
    - never
    - home_assistant
    - test

- name: Configure nginx proxy for home_assistant
  hosts: all
  become: true
  gather_facts: false
  vars:
    domain: "{{ home_assistant_domain }}"
    binded_port: "{{ home_assistant_internal_web_port }}"
    proxy_conf: |
      proxy_pass        http://127.0.0.1:{{ binded_port }};
      proxy_set_header  X-Script-Name /;
      proxy_set_header  X-Forwarded-For $proxy_add_x_forwarded_for;
      proxy_pass_header Authorization;
      proxy_http_version 1.1;
      proxy_set_header Upgrade $http_upgrade;
      proxy_set_header Connection "upgrade";
  roles:
    - role: add_nginx_proxy_conf
      tags: proxy
  tags:
    - never
    - home_assistant
    - test

## Kimai

- name: Deploy kimai in docker
  hosts: all
  become: true
  gather_facts: false
  vars:
    service_name: kimai
    docker_image: "{{ kimai_docker_image }}"
    create_volume: false
    docker_service_directory_db: "{{ kimai_directory.db }}"
    service_db_name: "{{ kimai_db_service_name }}"
    db_name: "{{ kimai_db_name }}"
    db_user: "{{ kimai_db_user }}"
    db_user_pass: "{{ kimai_db_user_pass }}"
    docker_command: |
      /usr/bin/docker run --rm --name "{{ service_name }}" \
      -p "{{ kimai_internal_web_port }}:8001" \
      -e "DATABASE_URL=mysql://{{ db_user }}:{{ db_user_pass }}@{{ service_db_name }}:3306/{{ db_name }}" \
      -e "APP_SECRET={{ kimai_app_secret }}" \
      -e "TRUSTED_PROXIES=localhost,127.0.0.1,172.0.0.0/8,{{ kimai_domain }}" \
      -e "TRUSTED_HOSTS=localhost,127.0.0.1,172.0.0.0/8,{{ kimai_domain }}" \
      -e "DATABASE_URL=mysql://{{ db_user }}:{{ db_user_pass }}@{{ service_db_name }}:3306/{{ db_name }}" \
      --network "{{ service_name }}" \
      "{{ docker_image }}"

  pre_tasks:
    - name: Create kimai directories 700
      become: true
      file:
        path: "{{ item }}"
        state: directory
        owner: "{{ user_uid_1000 }}"
        group: "{{ group_gid_1000 }}"
        mode: 0700
      with_items:
        - "{{ kimai_directory.db }}"

  post_tasks:
    - name: Wait for service to start
      ansible.builtin.uri:
        url: "http://127.0.0.1:{{ kimai_internal_web_port }}"
        status_code: 200
      register: kaimai_wait_result
      until: kaimai_wait_result.status == 200
      retries: 60
      delay: 5

    - name: Register admin user
      community.docker.docker_container_exec:
        container: kimai
        command: >-
          /opt/kimai/bin/console kimai:user:create
          {{ kimai_admin_user }}
          {{ kimai_admin_email }}
          ROLE_SUPER_ADMIN
          {{ kimai_admin_pass }}

  roles:
    - role: generic_docker_systemd
  tags:
    - never
    - kimai
    - test

- name: Get kimai subdomain Let's Encrypt certificate
  hosts: all
  become: true
  gather_facts: false
  vars:
    domain: "{{ kimai_domain }}"
    letsencrypt_renew_hook: /usr/sbin/service nginx reload
  roles:
    - role: letsencrypt_request
      tags: letsecrypt_request
  tags:
    - never
    - kimai
    - test

- name: Configure nginx proxy for kimai
  hosts: all
  become: true
  gather_facts: false
  vars:
    domain: "{{ kimai_domain }}"
    binded_port: "{{ kimai_internal_web_port }}"
    proxy_conf: |
      proxy_pass        http://127.0.0.1:{{ binded_port }};

      proxy_set_header  Host $http_host;
      proxy_set_header  X-Real-IP $remote_addr;
      proxy_set_header  X-Forwarded-Host $host:$server_port;
      proxy_set_header  X-Forwarded-Server $host;
      proxy_set_header  X-Forwarded-For $proxy_add_x_forwarded_for;
      proxy_set_header  X-Forwarded-Proto $scheme;
      proxy_set_header  X-Forwarded-Port $server_port;
  roles:
    - role: add_nginx_proxy_conf
      tags: proxy
  tags:
    - never
    - kimai
    - test

## Uptime Kuma

- name: Deploy kuma in docker
  hosts: all
  become: true
  gather_facts: false
  vars:
    service_name: kuma
    docker_image: "{{ kuma_docker_image }}"
    create_volume: false
    enable_db: false
    docker_command: |
      /usr/bin/docker run --rm --name "{{ service_name }}" \
      -p "{{ kuma_internal_web_port }}:3001" \
      -v "{{ kuma_directory.data }}:/app/data" \
      --network "{{ service_name }}" \
      "{{ docker_image }}"

  pre_tasks:
    - name: Create kuma directories 700
      become: true
      file:
        path: "{{ item }}"
        state: directory
        owner: root
        group: root
        mode: 0700
      with_items:
        - "{{ kuma_directory.data }}"

  roles:
    - role: generic_docker_systemd
  tags:
    - never
    - kuma
    - test

- name: Get kuma subdomain Let's Encrypt certificate
  hosts: all
  become: true
  gather_facts: false
  vars:
    domain: "{{ kuma_domain }}"
    letsencrypt_renew_hook: /usr/sbin/service nginx reload
  roles:
    - role: letsencrypt_request
      tags: letsecrypt_request
  tags:
    - never
    - kuma
    - test

- name: Configure nginx proxy for kuma
  hosts: all
  become: true
  gather_facts: false
  vars:
    domain: "{{ kuma_domain }}"
    binded_port: "{{ kuma_internal_web_port }}"
    proxy_conf: |
      proxy_set_header   X-Real-IP $remote_addr;
      proxy_set_header   X-Forwarded-For $proxy_add_x_forwarded_for;
      proxy_set_header   Host $host;
      proxy_pass         http://127.0.0.1:{{ binded_port }}/;
      proxy_http_version 1.1;
      proxy_set_header   Upgrade $http_upgrade;
      proxy_set_header   Connection "upgrade";
  roles:
    - role: add_nginx_proxy_conf
      tags: proxy
  tags:
    - never
    - kuma
    - test

## Umami

- name: Deploy umami in docker
  hosts: all
  become: true
  gather_facts: false
  vars:
    service_name: umami
    docker_image: "{{ umami_docker_image }}"
    create_volume: false
    create_network: true
    docker_service_directory_db: "{{ umami_directory.db }}"
    service_db_name: "{{ umami_db_service_name }}"
    db_type: postgres
    docker_db_image: "{{ umami_db_image }}"
    db_config_port: 5432
    db_name: "{{ umami_db_name }}"
    db_user: "{{ umami_db_user }}"
    db_user_pass: "{{ umami_db_user_pass }}"
    docker_command: |
      /usr/bin/docker run --rm --name "{{ service_name }}" \
      -p "{{ umami_internal_web_port }}:3000" \
      -e "DATABASE_URL=postgresql://{{ db_user }}:{{ db_user_pass }}@{{ service_db_name }}:5432/{{ db_name }}" \
      -e "DATABASE_TYPE=postgresql" \
      -e "HASH_SALT={{ umami_hash_salt }}" \
      --network "{{ service_name }}" \
      "{{ docker_image }}"

  pre_tasks:
    - name: Create umami directories 700
      become: true
      file:
        path: "{{ item }}"
        state: directory
        owner: "{{ user_uid_1000 }}"
        group: "{{ group_gid_1000 }}"
        mode: 0700
      with_items:
        - "{{ umami_directory.db }}"

  roles:
    - role: generic_docker_systemd
  tags:
    - never
    - umami
    - test

- name: Get umami subdomain Let's Encrypt certificate
  hosts: all
  become: true
  gather_facts: false
  vars:
    domain: "{{ umami_domain }}"
    letsencrypt_renew_hook: /usr/sbin/service nginx reload
  roles:
    - role: letsencrypt_request
      tags: letsecrypt_request
  tags:
    - never
    - umami
    - test

- name: Configure nginx proxy for umami
  hosts: all
  become: true
  gather_facts: false
  vars:
    domain: "{{ umami_domain }}"
    binded_port: "{{ umami_internal_web_port }}"
  roles:
    - role: add_nginx_proxy_conf
      tags: proxy
  tags:
    - never
    - umami
    - test