main.yml

---
- hosts: all
  vars:
    dpkg_architecture: "amd64"  # XXX $(dpkg --print-architecture)
    distro: "{{ ansible_facts['distribution'] | lower }}"
    docker_repo_url: "https://download.docker.com/linux/{{ distro }}"
    docker_keyring_path: "/etc/apt/trusted.gpg.d/docker-keyring.asc"
    google_keyring_path: "/etc/apt/trusted.gpg.d/google-keyring.asc"
    hashicorp_repo_url: "https://apt.releases.hashicorp.com"
    hashicorp_keyring_path: "/etc/apt/trusted.gpg.d/hashicorp-keyring.asc"
    cache_dir: ~/.cache/gbenson/ansible-machine-setup
    fonts_dir: ~/.local/share/fonts
    tic80_desktop_file: /usr/local/share/applications/tic80.desktop
    secrets_dir: ~/.config/gbenson/secrets
  vars_files:
    - vars/datalake.yml
    - vars/hivesite.yml
    - vars/network.yml
    - vars/openstack.yml

  tasks:
    #- debug:
    #    var: ansible_facts

    - name: Lock down various directories
      ansible.builtin.file:
        path: "{{ item }}"
        state: directory
        mode: "0700"
      loop:
        - ~/.ssh
        - "{{ secrets_dir }}"
        - "{{ datalake_config_dir }}"
        - "{{ hivesite_config_dir }}"
      tags:
        - secrets
        - openstack
        - datalake
        - hivesite

    - name: Lock down various files
      ansible.builtin.file:
        path: "{{ item }}"
        mode: "og-rwx"
      loop:
        - "{{ secrets_dir }}/ansible-machine-setup.vault"
      tags:
        - secrets

    - name: Install ~/.ssh/authorized_keys
      ansible.posix.authorized_key:
        user: "{{ lookup('env', 'USER') }}"
        state: present
        key: >
          {{ lookup('file',
          'dotfiles/ssh-authorized_keys',
          split_lines=False) }}

    - name: Configure /etc/hosts
      become: yes
      ansible.builtin.lineinfile:
        path: /etc/hosts
        line: "{{ addr }}\t{{ names | join(' ') }}"
      vars:
        names: "{{ static_hostnames[addr] }}"
      loop: "{{ static_hostnames | list }}"
      loop_control:
        loop_var: addr
      tags:
        - network

    - name: Uninstall problem packages
      become: yes
      ansible.builtin.apt:
        name: docker.io
        state: absent
      when: '"QUBES_ENV_SOURCED" not in ansible_facts["env"]'

    - name: Add Docker package signing key
      become: yes
      ansible.builtin.get_url:
        url: "{{ docker_repo_url }}/gpg"
        dest: "{{ docker_keyring_path }}"
      when: '"QUBES_ENV_SOURCED" not in ansible_facts["env"]'

    - name: Add Docker CE APT repository
      become: yes
      ansible.builtin.apt_repository:
        repo: >
          deb [arch={{ dpkg_architecture }}
          signed-by={{ docker_keyring_path }}]
          {{ docker_repo_url }}
          {{ ansible_distribution_release }}
          stable
        state: present
        filename: docker
      when: '"QUBES_ENV_SOURCED" not in ansible_facts["env"]'

    - name: Install Docker
      become: yes
      ansible.builtin.apt:
        pkg:
          - docker-ce
          - docker-compose-plugin
      when: '"QUBES_ENV_SOURCED" not in ansible_facts["env"]'

    - name: Add Chrome package signing key
      become: yes
      ansible.builtin.get_url:
        url: https://dl.google.com/linux/linux_signing_key.pub
        dest: "{{ google_keyring_path }}"
      when: ansible_facts["distribution"] == "Ubuntu"

    - name: Add Chrome APT repository
      become: yes
      ansible.builtin.apt_repository:
        repo: >
          deb [arch={{ dpkg_architecture }}
          signed-by={{ google_keyring_path }}]
          https://dl.google.com/linux/chrome/deb/
          stable main
        state: present
        filename: google-chrome
      when: ansible_facts["distribution"] == "Ubuntu"

    - name: Install Chrome
      become: yes
      ansible.builtin.apt:
        name: google-chrome-stable
      when: ansible_facts["distribution"] == "Ubuntu"

    - name: Add HashiCorp package signing key
      become: yes
      ansible.builtin.get_url:
        url: "{{ hashicorp_repo_url }}/gpg"
        dest: "{{ hashicorp_keyring_path }}"
      when: '"QUBES_ENV_SOURCED" not in ansible_facts["env"]'

    - name: Add HashiCorp APT repository
      become: yes
      ansible.builtin.apt_repository:
        repo: >
          deb [arch={{ dpkg_architecture }}
          signed-by={{ hashicorp_keyring_path }}]
          {{ hashicorp_repo_url }}
          {{ ansible_distribution_release }}
          main
        state: present
        filename: hashicorp
      when: '"QUBES_ENV_SOURCED" not in ansible_facts["env"]'

    - name: Add Golang Backports APT repository
      become: yes
      ansible.builtin.apt_repository:
        repo: ppa:longsleep/golang-backports
      when: ansible_facts["distribution"] == "Ubuntu"

    - name: Install packages
      become: yes
      ansible.builtin.apt:
        pkg:
          - awscli
          - bind9-dnsutils
          - curl
          - emacs-gtk
          - git
          - golang
          - elpa-dockerfile-mode
          - elpa-lua-mode
          - elpa-go-mode
          - elpa-markdown-mode
          - elpa-php-mode
          - elpa-yaml-mode
          - moreutils
          - mutt
          - python3-dev
          - python3-venv
          - terraform
          - tmux
          - whois
      when: >
        ansible_facts["os_family"] == "Debian"
        and "QUBES_ENV_SOURCED" not in ansible_facts["env"]

    - name: Install Debian-specific packages
      become: yes
      ansible.builtin.apt:
        pkg:
          - default-mysql-client
      tags:
        - never
      when: >
        ansible_facts["distribution"] == "Debian"
        and "QUBES_ENV_SOURCED" not in ansible_facts["env"]

    - name: Install Ubuntu-specific packages
      become: yes
      ansible.builtin.apt:
        pkg:
          - apport-retrace
          - bridge-utils
          - dnsmasq
          - gnome-tweaks
          - gobuster
          - guestfs-tools
          - hydra
          - iw
          - libosinfo-bin
          - libpcap-dev
          - mysql-client
          - nmap
          - openssh-server
          - p7zip
          - python2
          - ruby-dev
          - ruby-rubygems
          - virt-manager
          - wireshark
      when: ansible_facts["distribution"] == "Ubuntu"

    - name: Install docker-compose wrapper
      become: yes
      ansible.builtin.copy:
        dest: /usr/bin/docker-compose
        mode: "0755"
        content: |
          #!/bin/sh
          exec /usr/bin/docker compose "$@"
      when: ansible_facts["distribution"] == "Ubuntu"

    - name: Install dead-horse
      ansible.builtin.copy:
        src: dotfiles/dead-horse.sh
        dest: ~/.local/bin/dead-horse
        mode: "0755"
      when: '"QUBES_ENV_SOURCED" not in ansible_facts["env"]'

    - name: Configure grep
      ansible.builtin.lineinfile:
        path: ~/.bash_aliases
        regexp: ^alias\s+grep=
        line: >-
          alias grep='grep
          --color=auto
          --binary-files=without-match
          --exclude-dir=.git
          --exclude-dir=pdoc'
        create: yes

    - name: Configure git
      ansible.builtin.copy:
        src: dotfiles/gitconfig
        dest: ~/.gitconfig
        mode: "0644"
        backup: yes

    - name: Configure Docker
      become: yes
      ansible.builtin.user:
        name: "{{ lookup('env', 'USER') }}"
        groups: docker
        append: yes
      when: '"QUBES_ENV_SOURCED" not in ansible_facts["env"]'

    - name: Configure KVM
      become: yes
      ansible.builtin.user:
        name: "{{ lookup('env', 'USER') }}"
        groups: kvm
        append: yes
      when: ansible_facts["distribution"] == "Ubuntu"

    - name: Configure datalake and hivesite
      ansible.builtin.copy:
        dest: "{{ config_file['path'] }}"
        content: "{{ config_file['content'] }}"
        mode: "0600"
      loop: "{{ datalake_config_files + hivesite_config_files }}"
      loop_control:
        loop_var: config_file
      tags:
        - datalake
        - hivesite
      when: '"QUBES_ENV_SOURCED" not in ansible_facts["env"]'

    - name: Configure libvirt
      become: yes
      ansible.builtin.user:
        name: "{{ lookup('env', 'USER') }}"
        groups: libvirt, libvirt-qemu
        append: yes
      when: ansible_facts["distribution"] == "Ubuntu"

    - name: Configure Wireshark
      become: yes
      ansible.builtin.user:
        name: "{{ lookup('env', 'USER') }}"
        groups: wireshark
        append: yes
      when: ansible_facts["distribution"] == "Ubuntu"

    - name: Configure Redis
      ansible.builtin.lineinfile:
        path: /etc/redis/redis.conf
        regexp: ^#?\s*({{ item.keyword }})(\s+{{ item.args }})?
        line: \g<1> {{ item.args }}
        backrefs: yes
      loop:
        - { keyword: bind,           args: 127.0.0.1 }
        - { keyword: protected-mode, args: "yes" }
        - { keyword: maxclients,     args: 100 }
      tags:
        - redis
        - never
      become: yes
      when: '"QUBES_ENV_SOURCED" not in ansible_facts["env"]'

    - name: Enable and start Redis
      ansible.builtin.systemd:
        name: redis
        enabled: true
        masked: no
        state: started
      tags:
        - redis
        - never
      become: yes
      when: '"QUBES_ENV_SOURCED" not in ansible_facts["env"]'

    - block:
        - name: Install OpenStack credentials
          ansible.builtin.copy:
            dest: "{{ secrets_dir }}/openstack-openrc.sh"
            content: "{{ openstack_openrc_sh }}"
            mode: "0600"

        - name: Install OpenStack instance private key
          ansible.builtin.copy:
            dest: ~/.ssh/id_rsa_openstack
            content: "{{ openstack_ssh_id_rsa }}"
            mode: "0600"

        - name: Install OpenStack instance public key
          ansible.builtin.copy:
            dest: ~/.ssh/id_rsa_openstack.pub
            content: "{{ openstack_ssh_id_rsa_pub }}"
            mode: "0644"
      tags:
        - openstack

    - name: Configure Emacs
      ansible.builtin.git:
        repo: git@github.com:gbenson/emacs-config.git
        dest: ~/.emacs-config

    - name: Install ~/.emacs
      ansible.builtin.file:
        src: .emacs-config/dot.emacs
        dest: ~/.emacs
        state: link

    - name: Remove old Emacs config
      ansible.builtin.file:
        path: ~/.emacs.config
        state: absent

    # XXX needs password
    #- name: Configure Mutt
    #  ansible.builtin.git:
    #    repo: ssh://gbenson.git/git/config/dotmutt
    #    dest: ~/.mutt

    - name: Set ~/.muttrc permissions
      ansible.builtin.file:
        path: ~/.mutt
        state: directory
        mode: "0700"
      when: '"QUBES_ENV_SOURCED" not in ansible_facts["env"]'

    - name: Install ~/.muttrc
      ansible.builtin.file:
        src: .mutt/dot.muttrc
        dest: ~/.muttrc
        state: link
      when: '"QUBES_ENV_SOURCED" not in ansible_facts["env"]'

    - name: Configure GDB+debuginfod
      block:
        - name: Export DEBUGINFOD_URLS
          ansible.builtin.lineinfile:
            path: ~/.profile
            line: export DEBUGINFOD_URLS="https://debuginfod.ubuntu.com"

        - name: Enable debuginfod in ~/.gdbinit
          ansible.builtin.lineinfile:
            path: ~/.gdbinit
            line: set debuginfod enabled on
            create: yes
      when: ansible_facts["distribution"] == "Ubuntu"

    - name: Enable core deb-src repos
      become: yes
      ansible.builtin.lineinfile:
        path: /etc/apt/sources.list
        regexp: ^# (deb-src .* {{ item }} main restricted)$
        line: \g<1>
        backrefs: yes
      loop:
        - "{{ ansible_distribution_release }}"
        - "{{ ansible_distribution_release }}-updates"
        - "{{ ansible_distribution_release }}-security"
      when: ansible_facts["distribution"] == "Ubuntu"

    - name: Check if Lexend font exists
      ansible.builtin.stat:
        path: "{{ fonts_dir }}/Lexend-VariableFont_wght.ttf"
      register: lexend_ttf

    - block:
        - name: Ensure cache directory exists
          ansible.builtin.file:
            path: "{{ cache_dir }}"
            state: directory
            mode: "0700"

        - name: Download Lexend
          ansible.builtin.get_url:
            url: https://fonts.google.com/download?family=Lexend
            dest: "{{ cache_dir }}/lexend.zip"

        - name: Ensure fonts directory exists
          ansible.builtin.file:
            path: "{{ fonts_dir }}"
            state: directory
            mode: "0755"

        - name: Extract Lexend variable-weight font
          ansible.builtin.unarchive:
            src: "{{ cache_dir }}/lexend.zip"
            dest: "{{ fonts_dir }}"
            include: Lexend-VariableFont_wght.ttf
      when: >
        ansible_facts["distribution"] == "Ubuntu"
        and not lexend_ttf.stat.exists

    - name: Install TIC-80 build requirements
      become: yes
      ansible.builtin.apt:
        pkg:
          - cmake
          - freeglut3-dev
          - g++
          - libasound2-dev
          - libglu1-mesa-dev
          - libglvnd-dev
          - ruby-full
      when: ansible_facts["nodename"] == "molly"

    - name: Check whether TIC-80 is installed
      ansible.builtin.stat:
        path: "{{ tic80_desktop_file }}"
      register: tic80_desktop

    - name: Make TIC-80 fullscreen by default
      become: yes
      ansible.builtin.lineinfile:
        path: "{{ tic80_desktop_file }}"
        regexp: ^Exec=
        line: Exec=tic80 --fullscreen %U
      when: tic80_desktop.stat.exists

    - name: Install b2 build requirements
      become: yes
      ansible.builtin.apt:
        pkg:
          - libcurl4-openssl-dev
          - libgl1-mesa-dev
          - libglvnd-dev
          - libgtk2.0-dev
          - libpulse-dev
          - uuid-dev
          - libsdl2-dev
          - libuv1-dev
          - ninja-build
      when: ansible_facts["nodename"] == "molly"

    - block:
        - name: Find git repositories
          ansible.builtin.find:
            paths: ~/projects
            file_type: directory
            patterns: .git
            recurse: yes
            hidden: yes
            depth: 2
          register: git_repos

        - name: Configure git repositories
          include_tasks: "tasks/configure-git-repo.yml"
          loop: "{{ git_repos.files|flatten(levels=1) }}"
          loop_control:
            label: "{{ item.path|dirname }}"
      when: "'GBENSON_WORK_GIT' in ansible_facts['env']"

    # https://stackoverflow.com/questions/69938570/md4-hashlib-support-in-python-3-8
    - name: Make Python hashlib have md4
      block:
        - name: Activate [default_sect] in openssl.cnf
          become: yes
          ansible.builtin.lineinfile:
            path: /etc/ssl/openssl.cnf
            regexp: ^#\s*activate\s*=\s*1
            line: activate = 1
            insertafter: ^\[default_sect\]

        - name: Add and activate [legacy_sect] in openssl.cnf
          become: yes
          ansible.builtin.blockinfile:
            path: /etc/ssl/openssl.cnf
            block: |
              [legacy_sect]
              activate = 1

        - name: Load [legacy_sect] in openssl.cnf
          become: yes
          ansible.builtin.lineinfile:
            path: /etc/ssl/openssl.cnf
            line: legacy = legacy_sect
            insertafter: ^default = default_sect
      when: "'GBENSON_WORK_GIT' in ansible_facts['env']"