site.yml

## FIRST: edit the `vault_identity_list` in ``ansible.cfg``
# and make sure  you have all the password files you need.

## THEN

# Run this like so:
# ansible-playbook site.yml

# To only run this for planningalerts:
# ansible-playbook site.yml -l planningalerts

# To only run this for openaustralia:
# ansible-playbook site.yml -l openaustralia

# To show the value of an encrypted variable:
# ansible planningalerts -m debug -a 'var=mysql_password_production'
# Note that some values are different in development
# ansible development -m debug -a 'var=rds_admin_password'
#
# To encrypt a variable to the default vault id (requires ansible >=2.5.0):
#   ansible-vault encrypt_string --encrypt-vault-id default --name name secret
# To encrypt a variable to the EC2 vault id:
#   ansible-vault encrypt_string --encrypt-vault-id ec2 --name name secret
# See ansible.cfg for notes about which vault id to use.

# Use terraform (see terraform directory) to actually provision ec2 infrastructure

# Ubuntu 16.04 LTS doesn't come with python pre-installed. We need that for
# Ansible to work (for the gather facts). So install python first
- hosts: all
  become: true
  gather_facts: False

  tasks:
  - name: install python 2 (or python 3 on Ubuntu 20.04)
    raw: test -e /usr/bin/python || (apt -y update && apt install -y python-minimal) || apt install -y python-is-python3
    changed_when: False

- hosts: ec2
  become: true
  tasks:
    - name: Install pip
      apt:
        pkg: python-pip
      when: ansible_distribution_release != 'focal' and ansible_distribution_release != 'jammy'

    - name: Install pip
      apt:
        pkg: python3-pip
      when: ansible_distribution_release == 'focal' or ansible_distribution_release == 'jammy'

    - name: Install boto which is required for EC2 stuff
      pip: name=boto

    - name: Get information about the RDS instance
      rds:
        aws_access_key: "{{ aws_access_key }}"
        aws_secret_key: "{{ aws_secret_key }}"
        command: facts
        instance_name: main-database
        region: "{{ ec2_region }}"
      register: rds_mysql
      # Run this task even when running ansible-playbook with "--check"
      check_mode: no

    - name: Get information about the postgresql RDS instance
      rds:
        aws_access_key: "{{ aws_access_key }}"
        aws_secret_key: "{{ aws_secret_key }}"
        command: facts
        instance_name: postgresql
        region: "{{ ec2_region }}"
      register: rds_postgresql
      # Run this task even when running ansible-playbook with "--check"
      check_mode: no

    - name: Get information about the planningalerts RDS instance
      rds:
        aws_access_key: "{{ aws_access_key }}"
        aws_secret_key: "{{ aws_secret_key }}"
        command: facts
        instance_name: planningalerts
        region: "{{ ec2_region }}"
      register: rds_planningalerts
      # Run this task even when running ansible-playbook with "--check"
      check_mode: no

- hosts: all
  become: true
  roles:
    - base-server

- hosts: mysql
  become: true
  roles:
    - mysql

- hosts: postgresql
  become: true
  roles:
    - postgresql

- hosts: righttoknow
  become: true
  roles:
    - righttoknow

- hosts: planningalerts
  become: true
  roles:
    - planningalerts

- hosts: electionleaflets
  become: true
  roles:
    - electionleaflets

- hosts: theyvoteforyou
  become: true
  roles:
    - theyvoteforyou

- hosts: oaf
  become: true
  roles:
    - oaf

- hosts: openaustralia
  become: true
  roles:
    - openaustralia

- hosts: opengovernment
  become: true
  roles:
    - opengovernment

- hosts: proxy
  become: true
  roles:
    - proxy

- hosts: metabase
  become: true
  roles:
    - metabase

- hosts: plausible
  become: true
  roles:
    - plausible

- hosts: redis
  become: true
  tasks:
    - name: Install redis
      apt:
        name: redis
    - name: Make redis listen on 0.0.0.0
      lineinfile:
        path: /etc/redis/redis.conf
        regexp: "^bind 127.0.0.1"
        line: "bind 0.0.0.0"
      notify:
        - Restart redis
  handlers:
    - name: Restart redis
      service:
        name: redis
        state: restarted