deployment.yml

---
- name: deploy it infrastructure servers
  hosts: wasber
  remote_user: root

  pre_tasks:

    - name: Ensure a locale exists
      community.general.locale_gen:
        name: '{{ item }}'
      with_items:
        - en_US.UTF-8
        - de_DE.UTF-8

    - name: Set timezone to Europe/Berlin
      community.general.timezone:
        name: Europe/Berlin

    - name: Set hostname
      ansible.builtin.hostname:
        name: "{{ ansible_host }}"

    - name: import ssh keys for root
      # https://stackoverflow.com/a/48882051
      ansible.posix.authorized_key:
        user: root
        key: https://github.com/{{ item }}.keys
        comment: '{{ item }}'
      ignore_errors: yes
      with_items:
        - igami
        - leon2225
        - mattn81
        - bongald
        - stikkx
        - ReneHezser

    - name: Ensure /opt/containers/env_files directory exists
      ansible.builtin.file:
        path: /opt/containers/env_files
        state: directory
        mode: '0755'

    - name: copy email.env
      ansible.builtin.copy:
        src: defaults/opt/containers/env_files/email.env
        dest: /opt/containers/env_files/email.env

  roles:

    - role: weareinteractive.apt
      vars: 
        apt_upgrade: dist
        apt_unattended_upgrades_automatic_reboot: yes
        apt_unattended_upgrades_automatic_reboot_time: 02:00

    - role: nickjj.docker

    - role: roles/watchtower

    - role: roles/traefik-crowdsec-stack
      vars:
        # Service Traefik
        SERVICES_TRAEFIK_IMAGE_VERSION: latest
        SERVICES_TRAEFIK_LABELS_TRAEFIK_HOST: "`traefik.{{ ansible_host }}`"
        SERVICES_TRAEFIK_CERTIFICATESRESOLVERS_EMAIL: cyber@makerspace-gt.de

    - role: roles/zammad-stack
      vars:
        SERVICES_ZAMMAD_LABELS_TRAEFIK_HOST: "`helpdesk.makerspace-gt.de`"

      # # Restore Zammad Backup
      # # https://github.com/DoTheEvo/selfhosted-apps-docker/tree/master/zammad#backup-and-restore
      # # https://restic.readthedocs.io/en/stable/050_restore.html#
      # # https://docs.zammad.org/en/latest/install/docker-compose.html#how-to-run-commands-in-the-stack

      # docker compose --project-directory /opt/containers/zammad-stack down --remove-orphans 
      # docker exec resticker restic restore 74c4f304:/mnt/volumes/zammad --include zammad_production.pg_dump --target /mnt/volumes/zammad
      # docker compose --project-directory /opt/containers/zammad-stack up -d zammad-postgresql
      # docker compose --project-directory /opt/containers/zammad-stack exec zammad-postgresql bash -c "dropdb zammad_production -U zammad"
      # docker compose --project-directory /opt/containers/zammad-stack exec zammad-postgresql bash -c "createdb zammad_production -U zammad"
      # docker compose --project-directory /opt/containers/zammad-stack exec zammad-postgresql bash -c "psql -U zammad zammad_production < /var/tmp/zammad/zammad_production.pg_dump"
      # docker compose --project-directory /opt/containers/zammad-stack up -d --force-recreate
      # docker compose --project-directory /opt/containers/zammad-stack run --rm zammad-railsserver rake zammad:searchindex:rebuild

    - role: roles/vaultwarden
      vars:
        SERVICES_VAULTWARDEN_ENVIRONMENT_DOMAIN: "vault.makerspace-gt.de"

      # # Restore Vaultwarden Backup
      # # https://restic.readthedocs.io/en/stable/050_restore.html#

      # docker compose --project-directory /opt/containers/vaultwarden down --remove-orphans 
      # docker exec resticker restic restore a394d8e5:/mnt/volumes/vaultwarden --target /mnt/volumes/vaultwarden
      # docker compose --project-directory /opt/containers/vaultwarden up -d --force-recreate

    - role: roles/nextcloud-stack
      vars:
        NEXTCLOUD_OCC_COMMANDS:
        - config:system:set overwriteprotocol --value="https"
        - config:system:set maintenance_window_start --type=integer --value=1
        - db:add-missing-indices
        - config:system:set default_language --value="de"
        - config:system:set default_locale --value="de_DE"
        - config:system:set default_phone_region --value="DE"
        - config:system:set default_timezone --value="Europe/Berlin"
        - config:system:set upgrade.disable-web --type boolean --value true
        - config:system:set simpleSignUpLink.shown --type boolean --value false
        - config:system:set trusted_domains 1 --value={{ NEXTCLOUD_HOSTNAME }}
        - config:app:set dav generateBirthdayCalendar --value="no"
        - config:app:set registration admin_approval_required --value="yes"
        - config:app:set registration registered_user_group --value="makerspace-gt"
        - group:adduser makerspace-gt makerspace-gt
        - user:setting makerspace-gt settings email cyber@makerspace-gt.de
        NEXTCLOUD_DESIRED_GROUPFOLDERS:
          - name: Vorstand
            groups:
              - Vorstand: read write share delete
          - name: Bilder
            groups:
              - makerspace-gt: read write share delete
          - name: home
            groups:
            - makerspace-gt: read write share delete
          - name: hub
            groups:
            - makerspace-gt: read write share delete
          - name: Projekte
            groups:
            - makerspace-gt: read write share delete
          - name: Social Media
            groups:
            - Social Media: read write share delete
        NEXTCLOUD_HOSTNAME: "cloud.makerspace-gt.de"
        NEXTCLOUD_DESIRED_GROUPS:
          - Vorstand
          - makerspace-gt
          - Social Media
        NEXTCLOUD_DESIRED_ENABLED_APPS:
          - calendar
          - calendar_resource_management
          - cloud_federation_api
          - comments
          - contactsinteraction
          - dav
          - federatedfilesharing
          - federation
          - files
          - files_downloadlimit
          - files_pdfviewer
          - files_reminders
          - files_sharing
          - files_trashbin
          - files_versions
          - groupfolders
          - logreader
          - lookup_server_connector
          - notifications
          - oauth2
          - photos
          - previewgenerator
          - privacy
          - provisioning_api
          - registration
          - serverinfo
          - settings
          - sharebymail
          - systemtags
          - text
          - theming
          - twofactor_backupcodes
          - updatenotification
          - viewer
          - workflowengine

    - role: roles/vikunja-stack
      vars:
        SERVICES_LABELS_TRAEFIK_HOST: "todo.makerspace-gt.de"

        # # Restore Vikunja Backup
        # # https://vikunja.io/docs/what-to-backup
        # # https://www.postgresql.org/docs/current/backup-dump.html
        # # https://restic.readthedocs.io/en/stable/050_restore.html#

        # docker compose --project-directory /opt/containers/vikunja-stack stop vikunja
        # docker exec resticker restic restore e7947dde:/mnt/volumes/vikunja --target /mnt/volumes/vikunja
        # docker compose --project-directory /opt/containers/vikunja-stack exec db bash -c "dropdb vikunja -U vikunja"
        # docker compose --project-directory /opt/containers/vikunja-stack exec db bash -c "createdb vikunja -U vikunja"
        # docker compose --project-directory /opt/containers/vikunja-stack exec db bash -c "psql -U vikunja vikunja < /var/tmp/vikunja.pg_dump"
        # docker compose --project-directory /opt/containers/vikunja-stack up -d --force-recreate

    - role: roles/wikijs-stack
      vars:
        SERVICES_WIKIJS_LABELS_TRAEFIK_HOST: "`wiki.makerspace-gt.de`"

        # # Restore Wiki.js Backup
        # # https://docs.requarks.io/install/transfer
        # # https://www.postgresql.org/docs/current/backup-dump.html
        # # https://restic.readthedocs.io/en/stable/050_restore.html#

        # docker compose --project-directory /opt/containers/wikijs-stack stop wikijs
        # docker exec resticker restic restore 0941e370:/mnt/volumes/wikijs --include wikijs.pg_dump --target /mnt/volumes/wikijs
        # docker compose --project-directory /opt/containers/wikijs-stack exec wikijs-postgres bash -c "dropdb wikijs -U wikijs"
        # docker compose --project-directory /opt/containers/wikijs-stack exec wikijs-postgres bash -c "createdb wikijs -U wikijs"
        # docker compose --project-directory /opt/containers/wikijs-stack exec wikijs-postgres bash -c "psql -U wikijs wikijs < /var/tmp/wikijs.pg_dump"
        # docker compose --project-directory /opt/containers/wikijs-stack up -d --force-recreate

    - role: roles/resticker-stack