- name: check/create instance
  hosts: copr-be.cloud.fedoraproject.org
  user: root
  gather_facts: False

  vars_files: 
   - /srv/web/infra/ansible/vars/global.yml
   - "{{ private }}/vars.yml"

  tasks:
  - include: "{{ tasks }}/persistent_cloud.yml"
  - include: "{{ tasks }}/growroot_cloud.yml"

- name: provision instance
  hosts: copr-be.cloud.fedoraproject.org
  user: root
  gather_facts: True
  
  vars_files: 
   - /srv/web/infra/ansible/vars/global.yml
   - "{{ private }}/vars.yml"
   - /srv/web/infra/ansible/vars/{{ ansible_distribution }}.yml

  # Roles are run first, before tasks, regardless of where you place them here.
  roles:
  - fedmsg/base

  tasks:
  - include: "{{ tasks }}/cloud_setup_basic.yml"
  - include: "{{ tasks }}/iptables.yml"
  - include: "{{ tasks }}/common_scripts.yml"

  - name: prepare mount point
    action: file state=directory path=/var/lib/copr/public_html

  - name: mount up disk of copr repo
    action: mount name=/var/lib/copr/public_html src='LABEL=copr-repo' fstype=ext4 state=mounted

  - name: mount /tmp/
    action: mount name=/tmp src='tmpfs' fstype=tmpfs state=mounted

  # We cannot use repo pointing to ourselfs :(
  #- name: copy copr.repo
  #  action: copy src=$files/copr/fe/yum/copr.repo dest=/etc/yum.repos.d/copr.repo

  - name: set the hostname
    shell: hostname copr-be.cloud.fedoraproject.org

  - name: copy .forward file
    action: copy src="{{ files }}/copr/forward" dest=/root/.forward owner=root group=root

  - name: deploy /etc/hosts file
    action: copy src="{{ files }}/copr/hosts" dest=/etc/hosts owner=root group=root mode=644

  # packages needed
  - name: add packages for copr-be
    action: yum state=present name={{ item }}
    with_items:
    - copr-selinux
    - copr-backend
    - git
    - screen
    - fail2ban
    - system-config-firewall-base
    - python-novaclient
    

  - name: make copr dirs
    file: state=directory path={{ item }}
    with_items:
    - /var/lib/copr/jobs
    - /var/lib/copr/public_html/results

  - name: Umask results
    action: command /usr/bin/umask 0000 chdir=/var/lib/copr/public_html/results

  - name: setup dirs there
    action: file state=directory path="/home/copr/{{ item }}" owner=copr group=copr mode=0700
    with_items: 
    - cloud
    - .ssh

  - name: add copr-buildsys keys to copr user path
    action: copy src={{ item }} dest=/home/copr/cloud/ owner=copr group=copr mode=0600
    with_fileglob:
     - "{{ private }}/files/openstack/copr-copr/*"

  - name: setup privkey for copr user
    action: copy src="{{ private }}/files/copr/buildsys.priv" dest=/home/copr/.ssh/id_rsa owner=copr group=copr mode=600

  - name: setup copr user ssh config file
    action: copy src="{{ files }}/copr/ssh_config" dest=/home/copr/.ssh/config  owner=copr group=copr mode=600

  - name: create empty known_hosts
    action: copy src=/dev/null dest=/home/copr/.ssh/known_hosts owner=copr group=copr mode=600

  - name: replace bashrc for copr user
    action: copy src="{{ files }}/copr/copr_bashrc" dest=/home/copr/.bashrc owner=copr group=copr mode=600

  - name: auth_key so we can login to localhost as the copr user from the copr user
    action: authorized_key user=copr key="{{ item }}"
    with_file:
    - "{{ files }}/copr/provision/files/buildsys.pub"

  - name: copy keystonerc
    action: template src="{{ files }}/copr/keystonerc" dest=/root/ owner=root group=root mode=600

  - name: copy .boto file
    action: copy src="{{ files }}/copr/boto" dest=/home/copr/.boto owner=copr group=copr
 
  # setup webserver
  - name: add config for copr-repo path
    action: copy src="{{ files }}/copr/lighttpd/lighttpd.conf" dest=/etc/lighttpd/lighttpd.conf owner=root group=root mode=0644
    notify: 
    - restart lighttpd

  - name: copy httpd ssl certificates
    action: copy src="{{ puppet_private }}/httpd/{{ item }}" dest="/etc/lighttpd/{{ item }}" owner=root group=root mode=0600
    with_items:
    - copr-be.fedoraproject.org.key
    - copr-be.fedoraproject.org.crt
    notify:
    - concate ssl certs
    tags:
    - config 

  - name: copy httpd ssl certificates (CAcert)
    action: copy src="{{ files }}/copr/DigiCertCA.crt" dest="/etc/lighttpd/" owner=root group=root mode=0600
    tags:
    - config
    notify:
    - restart lighttpd

  # mime default to text/plain and enable dirlisting for indexes
  - name: update lighttpd configs
    action: copy src="{{ files }}/copr/lighttpd/{{ item }}" dest="/etc/lighttpd/conf.d/{{ item }}" owner=root group=root mode=0644
    with_items:
    - dirlisting.conf
    - mime.conf
    notify: 
    - restart lighttpd

  - name: start webserver
    service: state=running enabled=yes name=lighttpd

  - name: start fail2ban
    service: state=running enabled=yes name=fail2ban

  # setup dirs for the ansible execution off of provisioning
  - name: dirs from provision
    action: file state=directory path="/home/copr/provision/{{ item }}" owner=copr group=copr
    with_items:
    - action_plugins
    - library
    - files
    - files/mock
    tags:
    - provision_config

  - name: put ansible.cfg for all this into /etc/ansible/ on the system
    action: copy src="{{ files }}/copr/provision/ansible.cfg" dest=/etc/ansible/ansible.cfg
    tags:
    - provision_config


  - name: put some files into the provision subdir
    action: template src="{{ files }}/copr/provision/{{ item }}" dest="/home/copr/provision/{{ item }}"
    with_items:
    - inventory
 #   - builderpb.yml
    - terminatepb.yml
    tags:
    - provision_config

  - name: put files into the files subdir off of provisioning
    action: copy src={{ item }} dest=/home/copr/provision/files/
    with_fileglob:
     - "{{ files }}/copr/provision/files/*"
    tags:
    - provision_config

  # ansible lacks a recurse - so we need this until then
  - name: put files into the files/mock subdir off of provisioning
    action: copy src={{ item }} dest=/home/copr/provision/files/mock
    with_fileglob:
     - "{{ files }}/copr/provision/files/mock/*"
    tags:
    - provision_config

  - name: copy copr-be.conf
    template: src="{{ files }}/copr/copr-be.conf" dest=/etc/copr/copr-be.conf  owner=root group=copr mode=640
    notify:
    - restart copr-backend
    tags:
    - config

  - name: copy delete-forgotten-instances.pl
    action: copy src="{{ files }}/copr/delete-forgotten-instances.pl" dest=/home/copr/delete-forgotten-instances.pl mode=755

  - name: copy delete-forgotten-instances.cron
    action: copy src="{{ files }}/copr/delete-forgotten-instances.cron" dest=/etc/cron.daily/delete-forgotten-instances owner=root group=root mode=755

  handlers:
  - include: "{{ handlers }}/restart_services.yml"
  - name: concate ssl certs
    action: shell "cat /etc/lighttpd/copr-be.fedoraproject.org.key /etc/lighttpd/copr-be.fedoraproject.org.crt > /etc/lighttpd/copr-be.fedoraproject.org.pem"
    notify:
    - chmod_key
    - restart lighttpd
  - name: chmod_key
    action: file path=/etc/lighttpd/copr-be.fedoraproject.org.pem owner=root group=root mode=0600
  - name: restart copr-backend
    service: name=copr-backend state=restarted
  - name: restart lighttpd
    service: name=lighttpd state=restarted
