wai.yml

---
# Main WAI playbook

# Ansible version (kubspray requirement - stop early if not met)
- hosts: localhost
  become: false
  tasks:
    - name: "Check ansible version >=2.7.8 and <2.8"
      assert:
        msg: "Ansible must be v2.7.8 or higher but lower than 2.8"
        that:
          - ansible_version.string is version("2.7.8", ">=")
          - ansible_version.string is version("2.8.0", "<")
      tags:
        - check

# Load data from hosts
- hosts: wai
  tasks:
    - name: WAI Gather facts
      debug:
        msg: "Just to load data"

# Prepare infrastructure Root CA
- hosts: localhost
  gather_facts: no
  tasks:
    - name: Prepare infrastructure Root CA
      tags:
        - install
        - infrastructure
        - wai-infrastructure-ca
      import_tasks: wai-infrastructure-ca.yml

# Infrastructure requirements
- hosts: wai
  gather_facts: no
  tags:
    - infrastructure
  roles:
    - infrastructure
  vars_files: secrets.yml
  post_tasks:
    - name: WAI Infrastructure CA .:. Copy SSL artifacts
      copy:
        src: "{{ item }}"
        dest: "{{ wai_infrastructure_ca.root_folder }}/"
        mode: "0444"
        owner: root
        group: root
      with_items:
      - "{{ wai_infrastructure_ca.root_folder }}/crt/wai-ca.crt"
      - "{{ wai_infrastructure_ca.root_folder }}/key/{{ inventory_hostname }}.key"
      - "{{ wai_infrastructure_ca.root_folder }}/crt/{{ inventory_hostname }}.crt"

    - name: WAI Infrastructure CA .:. Copy WAI Infrastructure CA
      copy:
        src: "{{ wai_infrastructure_ca.root_folder }}/crt/wai-ca.crt"
        dest: "/usr/local/share/ca-certificates"
        owner: root
        group: root
        mode: 0644

    - name: WAI Infrastructure CA .:. Update root CA
      shell: /usr/sbin/update-ca-certificates

# Open VPN Server
- hosts: localhost
  gather_facts: no
  tags:
    - openvpn
  roles:
    - openvpn_server

# Install elastic search
- hosts: elastic
  gather_facts: no
  vars_files:
    - secrets.yml
  vars:
    es_ssl_key_password: "{{ elasticsearch_secrets.ssl_key_password }}"
    es_api_host: "{{ hostvars[inventory_hostname].ansible_default_ipv4.address }}"
    es_ssl_key: "{{ wai_infrastructure_ca.root_folder }}/key/elastic.key"
    es_ssl_certificate: "{{ wai_infrastructure_ca.root_folder }}/crt/elastic.crt"
  tags:
    - install
    - elastic
    - production
  roles:
    - elastic.elasticsearch
    - prometheus_node_exporter

# Install kibana
- hosts: kibana
  gather_facts: no
  vars_files:
    - secrets.yml
  tags:
    - install
    - kibana
    - production
  roles:
    - kibana

# Install galera prod cluster
- hosts: galera-prod
  gather_facts: no
  vars_files:
    - secrets.yml
  tags:
    - install
    - galera
    - production
  roles:
    - galera
    - prometheus_node_exporter
    - prometheus_mysqld_exporter

# Install galera prod slave cluster
- hosts: galera-prod-slave
  gather_facts: no
  vars_files:
    - secrets.yml
  tags:
    - install
    - galera
    - production
  roles:
    - galera
    - prometheus_node_exporter
    - prometheus_mysqld_exporter

# Install galera public play ground cluster
- hosts: galera-play
  gather_facts: no
  vars_files: secrets.yml
  tags:
    - install
    - galera
    - public-playground
  roles:
    - galera
    - prometheus_node_exporter
    - prometheus_mysqld_exporter

# Install mariadb stage server
- hosts: mariadb-stag
  gather_facts: no
  vars_files: secrets.yml
  tags:
    - install
    - mariadb
    - staging
  roles:
    - mariadb
    - prometheus_node_exporter
    - prometheus_mysqld_exporter

# Install GlusterFS server
- hosts: gluster
  gather_facts: no
  vars_files: secrets.yml
  vars:
    heketi_cert_file: "{{ wai_infrastructure_ca.root_folder }}/{{ inventory_hostname }}.crt"
    heketi_key_file: "{{ wai_infrastructure_ca.root_folder }}/{{ inventory_hostname }}.key"
  tags:
    - install
    - gluster
    - production
  roles:
    - glusterfs
    - heketi
    - prometheus_node_exporter

# Install GlusterFS client
- hosts: kube-node
  gather_facts: no
  tags:
    - install
    - gluster
    - production
  roles:
    - glusterfs.client

# Deploy Elatic extra data
- name: Deploy Elasticsearch data
  tags:
    - deploy
    - elastic-deploy
  import_playbook: elastic.yml

# Deploy Matomo database
- name: Deploy Matomo database
  tags:
    - deploy
    - matomo
  import_playbook: database.yml

# Install K8S cluster
- name: Kubernetes cluster
  tags:
    - install
    - kubernetes
    - production
  import_playbook: kubespray/cluster.yml

# Configure K8S resources
- name: Deploy WAI K8S resources
  tags:
    - deploy
    - kubernetes-deploy
  import_playbook: k8s-deployment.yml

# Configure K8S helm resources
- name: Deploy WAI K8S Helm resources
  tags:
    - deploy
    - kubernetes-deploy-helm
  import_playbook: k8s-helm-charts.yml

# Enable apt automatic update
- hosts: wai
  gather_facts: no
  tasks:
  - name: Enable APT automatic update
    raw: systemctl enable --now {{ item }}
    with_items:
      - 'apt-daily.timer'
      - 'apt-daily-upgrade.timer'
  - name: Reload systemctl daemon-reload
    raw: systemctl daemon-reload

# Because of https://github.com/kubernetes/kubernetes/issues/68607 remove proxy settings if configured
# Kubectl uses proxy settings for livenessProbe and readinessProbe so remove env proxy settings and restart kubelet
- hosts: k8s-cluster
  gather_facts: no
  tasks:
    - name: Remove http proxy to environment
      lineinfile:
          path: /etc/environment
          state: absent
          regexp: "^http_proxy"
      when:
          - http_proxy is defined

    - name: Remove https proxy to environment
      lineinfile:
          path: /etc/environment
          state: absent
          regexp: "^https_proxy"
      when:
          - https_proxy is defined

    - name: Restart kubectl
      service:
          name: kubelet
          state: restarted
      when:
          - https_proxy is defined or http_proxy is defined

- hosts: localhost
  gather_facts: no
  vars_files: secrets.yml
  tasks:
    - name: K8S .:. Compile templates locally
      vars:
        wai_k8s_deployment_dir: "{{ playbook_dir }}/compiled-templates/k8s"
        wai_infrastructure_ca:
          root_folder: "{{ playbook_dir }}/compiled-templates/ca"
          secrets:
            ca_key_password: secret_key_password
      tags:
        - never
        - templates
      import_tasks: k8s-templates.yml

- hosts: localhost
  gather_facts: no
  vars_files: secrets.yml
  tasks:
    - name: Database .:. Compile templates locally
      vars:
        db_dump_dir: "{{ playbook_dir }}/compiled-templates/db"
        wai_environment: "{{ item }}"
      tags:
        - never
        - templates
      import_tasks: db-templates.yml