---
### Playbook for internalIT Systems from 2023
#   perfact-login[-devel | -prod | -localdev]
#   perfact-mail           ""
#   perfact-file           ""

### These servers are entirely managed by Ansible.
# Don't make any local modifications as they are invisible in this repo and
# might be overwritten.

# All systems are availible as localVM.
# Use this localVMs for development and testing.

### This playbook uses Ansible vault. See the documentation on how to use it.
# E.g. `--ask-vault-pass` or `--vault-password-file`
#
# Differnet vault secrets for the productiion- and devel- system.
# If only one vault secret is available to run the playbook,
# the unused one needs to be commented.
#
# If you have access to both secrets run with both --vault-password:
# ansible-playbook  playbook_perfact-login.yml --diff --vault-password-file .vault-password-perfact-mail-prod --vault-password-file .vault-password-perfact-mail-devel --limit perfact-mail-prod --check


### An execution of single task is possible with:
# to only apply firewall configuration, use `--tags pffirewall`.
# to only apply perfact-measure, use        `--tags perfact-measure`.
# to only apply perfact-monit, use          `--tags monit`.
# to only apply pfpyroutinecheck, use       `--tags pyroutinecheck`.
# to only apply massage of the day, use     `--tags motd`.
# to only apply ldap, use                   `--tags ldap`.
# to only apply ldap-pam, use               `--tags ldap-pam`.
# to only apply postfix, use                `--tags postfix`.
# to only apply dhcp-server, use            `--tags dhcp`.
# to only apply bind, use                   `--tags bind`.
# to only apply new DNS-Zones, use          `--tags bind-zones`.
# ...
#
# to get an overview of all possible tags run:
# ansible-playbook playbook_perfact-internal-server --vault-password-file .vault-devel --list-tags


#######################################################################
# Deploys the primary loginserver
# the server does:
#  - ldap master
#  - olpg-login
#  - pf_verbingungskonfiguration
#  - Primary DNS
#  - DHCP-Server for LAN

#####          devel               local vm
- hosts: perfact-login-devel perfact-login-localdev
  vars_files:
    - internalit/vault_perfact_devel.yml
    - internalit/vars.yml
  roles:
    - roles/general/git-pre-commit
    - internalit/roles/perfact-login
    - internalit/roles/ldap
    - internalit/roles/ldap-pam
    # include bind9 DNS Server
    - roles/general/bind9
    # no dhcp on devel - only one is allowed
    # create less tickets: intall monit at last task
    - roles/general/perfact-monit
    - roles/general/git-post-commit

- hosts: perfact-login-localdev
  roles:
    # include isc-dhcp-server on localdev only
    - roles/general/isc-dhcpd

#####          prod
- hosts: perfact-login-prod test-perfact-login-prod
  vars_files:
    # vaults for prod are commented because not everyone has the password
#    - internalit/vault_perfact_prod.yml
    - internalit/vars.yml
  roles:
    - roles/general/git-pre-commit
    - internalit/roles/perfact-login
    - internalit/roles/ldap
    - internalit/roles/ldap-pam
    # bind9 DNS Server
    - roles/general/bind9
    # isc-dhcp-server
    - roles/general/isc-dhcpd
    # create less tickets: intall monit at last task
    - roles/general/perfact-monit
    - roles/general/git-post-commit


#######################################################################
# Deploys the primary mailserver
# the server does:
#  - ldap slave
#  - postfix mailserver with
#  - dovecot
#  - roundcube
#  - rspamd

#####          devel               local vm
- hosts: perfact-mail-devel perfact-mail-localdev
  vars_files:
    - internalit/vault_perfact_devel.yml
    - internalit/vars.yml
  roles:
    - roles/general/git-pre-commit
    - internalit/roles/perfact-mail
    - internalit/roles/ldap
    - internalit/roles/perfact-mail/postfix
    - internalit/roles/perfact-mail/dovecot
    - internalit/roles/perfact-mail/rspamd
    - internalit/roles/perfact-mail/roundcube
    # create less tickets: intall monit at last task
    - roles/general/perfact-monit
    - roles/general/git-post-commit

#####          prod
- hosts: perfact-mail-prod
  vars_files:
    # vaults for prod are commented because not everyone has the password
#    - internalit/vault_perfact_prod.yml
    - internalit/vars.yml
  roles:
    - roles/general/git-pre-commit
    - internalit/roles/perfact-mail
    - internalit/roles/ldap
    - internalit/roles/perfact-mail/postfix
    - internalit/roles/perfact-mail/dovecot
    - internalit/roles/perfact-mail/rspamd
     # certsync - nicht notwendig - perfact-mail verwendet ein
     # selbst-signiertes Zertifikat. Die Kommunikation läuft ausschließlich über
     # den HA-Proxy der PF-Sense.
    # create less tickets: intall monit at last task
    - roles/general/perfact-monit
    - roles/general/git-post-commit

- hosts: perfact-ema-2022-devel perfact-ema-2022-prod pf-pfonehome-2020-prod
  roles:
    - roles/general/git-pre-commit
    - internalit/roles/user_perfact_useradmin
    - roles/general/git-post-commit

###############################################################################
# Deploys the fileserver
# the server does:
#  - cups
#  - samba
#  - ldap-pam
#
# Execution of the playbook:
#
#   ansible-playbook playbook_perfact-internal-server.yml \
#     --vault-password-file .vault-devel --limit perfact-file-devel \
#     --diff --check
#
#        devel              localdev
- hosts: perfact-file-devel perfact-file-localdev
  vars_files:
    - internalit/vault_perfact_devel.yml
    - internalit/vars.yml
  roles:
    - roles/general/git-pre-commit
    - internalit/roles/perfact-file
    - internalit/roles/perfact-file/volumes
    - internalit/roles/perfact-file/cups
    - internalit/roles/perfact-file/samba
    - internalit/roles/ldap-pam
    - internalit/roles/ldap
    - roles/general/rsnapshot-local-backup
    # create less tickets: intall monit at last task
    - roles/general/perfact-monit
    - roles/general/git-post-commit

#    prod
- hosts: perfact-file-prod
  vars_files:
    # vaults for prod are commented because not everyone has the password
#    - internalit/vault_perfact_prod.yml
    - internalit/vars.yml
  roles:
    - roles/general/git-pre-commit
    - internalit/roles/perfact-file
    - internalit/roles/perfact-file/volumes
    - internalit/roles/perfact-file/cups
    - internalit/roles/perfact-file/samba
    - internalit/roles/ldap-pam
    - internalit/roles/ldap
    - roles/general/rsnapshot-local-backup
    # create less tickets: intall monit at last task
    - roles/general/perfact-monit
    - roles/general/git-post-commit

