provision.yml

---
# Playbook for setting up a new webserver
- hosts: all
  become: yes
  vars:
    ansible_become_pass: '{{ ansible_pass }}'
    ansible_user: ansible

  tasks:
  - name: Install nginx
    apt:
      name: nginx
      state: present

  - name: Copy nginx site config
    copy:
      src: files/bidchowder.conf
      dest: /etc/nginx/sites-available
      mode: 0644
    notify:
      - restart nginx

  - name: Create well-known directory
    file:
      path: /var/www/letsencrypt
      state: directory
      mode: 0755

  - name: Install and configure certbot
    include_role:
      name: geerlingguy.certbot
    vars:
      certbot_auto_renew_user: root
      certbot_auto_renew_options: >-
        --quiet --no-self-upgrade --webroot -w /var/www/letsencrypt/
        --deploy-hook "systemctl reload nginx"
      certbot_create_if_missing: True
      certbot_create_method: standalone
      certbot_admin_email: jayson.cleary@gmail.com
      certbot_create_standalone_stop_services: nginx
      certbot_certs:
        - domains:
          - www.bidchowder.com

  - name: Nginx cert directory
    file:
      path: /etc/nginx/certs
      state: directory

  - name: Generate dh params
    command: openssl dhparam -out /etc/nginx/certs/dhparams.pem 2048
    args:
      creates: /etc/nginx/certs/dhparams.pem

  - name: Update default enabled site
    file:
      state: link
      src: /etc/nginx/sites-available/bidchowder.conf
      dest: /etc/nginx/sites-enabled/default
    notify:
      - restart nginx

  - name: Add CI/CD group
    group:
      name: ci-cd

  # hook role sets a new_user variable
  - name: Install webhook handler
    include_role:
      name: hooks
    vars:
      hook_command_path: "{{ deploy_install_location }}"
      hook_user_groups:
        - ci-cd

  - name: Add script called by hooks
    copy:
      src: files/update-and-start-deploy.sh
      dest: "{{ deploy_install_location }}"
      owner: "{{ new_user.name }}"
      group: "{{ new_user.group }}"

  - name: Add settings file used by deploy script
    template:
      src: templates/site-settings.sh.j2
      dest: "{{ deploy_install_dir }}site-settings.sh"
      owner: "{{ new_user.name }}"
      group: "{{ new_user.group }}"
      mode: 0660

  - name: Create service for startup
    template:
      src: templates/start-bidsoup.service.j2
      dest: /etc/systemd/system/start-bidsoup.service
      mode: 0644
    vars:
      run_user: "{{ new_user.name }}"

  - name: Enable start-bidsoup service
    systemd:
      name: start-bidsoup
      enabled: yes

  - name: Clone repo
    git:
      repo: 'git@github.com:mardotio/bidsoup.git'
      dest: /var/code/bidsoup
      key_file: "{{ new_user.ssh_key_file }}"
      force: yes
      umask: '002'
    notify: setup repo permissions

  - name: Install Docker
    include_role:
      name: geerlingguy.docker
    vars:
      docker_users:
        - jayson
        - mardotio
        - "{{ new_user.name }}"

  - name: Create data mount directory
    file:
      path: /var/lib/bidsoup/data/prod
      state: directory
      group: docker
      mode: 0774

  handlers:
    - name: restart nginx
      systemd:
        name: nginx
        state: restarted

    - name: Set repo sharable
      shell: git config --add core.sharedRepository group
      args:
        chdir: /var/code/bidsoup
      listen: setup repo permissions

    - name: Update repo permissions
      file:
        path: /var/code/bidsoup
        recurse: yes
        owner: hooker
        group: ci-cd
      listen: setup repo permissions

    - name: Set .git directory to sticky group
      file:
        path: /var/code/bidsoup/.git
        mode: g+s
      listen: setup repo permissions