main.yml

---
- name: Basic Setup
  hosts: all
  become: yes
  tags:
    - base
  vars_files:
    - vars.yml
  roles:
    - base

- name: Base User setup/update
  hosts: all
  become: yes
  tags:
    - base
    - user
  vars_files:
    - vars.yml
  roles:
    - base-user

- name: Monitored host
  hosts: all
  become: yes
  tags:
    - monitoring
  vars:
    _node_exporter_binary_install_dir: '/opt/node_exporter'
    _node_exporter_system_group: 'prometheus'
    _node_exporter_system_user: 'prometheus'
  roles:
    - cloudalchemy.node-exporter
    - node-exporter-ufw
    - cloudalchemy.process_exporter
    - process-exporter-ufw

- name: TURN Server
  hosts: turn
  become: yes
  tags:
    - turn
  vars_files:
    - vars.yml
  vars:
    nginx_ipv4: "{{ turn_ipv4 }}"
    nginx_ipv6: "{{ turn_ipv6 }}"
    nginx_config_name: "turn"
    nginx_domain: "{{ turn_hostname }}"
    no_https: true
  roles:
    - nginx
    - turn

- name: BigBlueButton
  hosts: bbb
  become: yes
  tags:
    - bbb
  vars_files:
    - vars.yml
  vars:
    nginx_ipv4: "{{ web_ipv4 }}"
    nginx_ipv6: "{{ web_ipv6 }}"
    nginx_config_name: "bbb"
    nginx_domain: "{{ inventory_hostname }}"
    bbb_hostname: "{{ inventory_hostname }}"
    bbb_meteor: {}
  roles:
    - nginx
    - bbb-ori

- name: BBB Exporter
  hosts: bbb
  become: yes
  tags:
    - bbb
  roles:
    - bbb-exporter

- name: Scalelite #BBB-Loadbalancer
  hosts: scalelite
  become: yes
  tags:
    - loadbalancer
  vars_files:
    - vars.yml
  vars:
    nginx_ipv4: "{{ web_ipv4 }}"
    nginx_ipv6: "{{ web_ipv6 }}"
    nginx_config_name: "loadbalancer"
    nginx_domain: "{{ loadbalancer_hostname }}"
    redis_port: 6379
    redis_bind_interface: 127.0.0.1
    ruby_install_from_source: yes
    ruby_version: 2.6.6
    ruby_download_url: https://cache.ruby-lang.org/pub/ruby/2.6/ruby-2.6.6.tar.gz
    ruby_install_bundler: yes
    postgresql_hba_entries:
      - {type: local, database: all, user: postgres, auth_method: peer}
      - {type: local, database: all, user: all, auth_method: peer}
      - {type: host, database: all, user: all, address: '127.0.0.1/32', auth_method: md5}
      - {type: host, database: all, user: all, address: '::1/128', auth_method: md5}
    postgresql_users:
      - name: scalelite
        state: present
        password: "{{ scalelite_postgres_password }}"
    postgresql_databases:
      - name: scalelite
        owner: scalelite
        state: present
  pre_tasks:
    # needed for geerlingguy.postgresql
    - name: make shure libpq-dev is installed
      apt:
        name: libpq-dev
        update_cache: yes
        cache_valid_time: 3600
    - name: Make sure psycopg2 is installed
      pip:
        name: psycopg2
        state: present
  roles:
    - nginx
    - geerlingguy.redis
    - role: geerlingguy.postgresql
      become: yes
    - geerlingguy.ruby
    - scalelite

- name: Register BBBs at Loadbalancer
  hosts: scalelite
  become: yes
  tags:
    - loadbalancer
    - config
  roles:
    - scalelite-config

- name: Frontend - Greenlight
  hosts: greenlight
  become: yes
  vars_files:
    - vars.yml
  tags:
    - frontend
    - greenlight
  vars:
    nginx_ipv4: "{{ web_ipv4 }}"
    nginx_ipv6: "{{ web_ipv6 }}"
    nginx_config_name: "webui"
    nginx_domain: "{{ inventory_hostname }}"
    nginx_alias:
      - "www.{{ inventory_hostname }}"
    lb_url: "{{ scalelite_loadbalancer_url }}"
    lb_secret: "{{ scalelite_loadbalancer_secret }}"
    redis_port: 6379
    redis_bind_interface: 127.0.0.1
    ruby_install_from_source: yes
    ruby_version: 2.6.6
    ruby_download_url: https://cache.ruby-lang.org/pub/ruby/2.6/ruby-2.6.6.tar.gz
    ruby_install_bundler: yes
    nodejs_version: "12.x"
    postgresql_hba_entries:
      - {type: local, database: all, user: postgres, auth_method: peer}
      - {type: local, database: all, user: all, auth_method: peer}
      - {type: host, database: all, user: all, address: '127.0.0.1/32', auth_method: md5}
      - {type: host, database: all, user: all, address: '::1/128', auth_method: md5}
    postgresql_users:
      - name: greenlight
        state: present
        password: "{{ greenlight_postgres_password }}"
        role_attr_flags: CREATEDB # rake db:migrate needs priv
    postgresql_databases:
      - name: greenlight_production
        owner: greenlight
        state: present
  pre_tasks:
    # needed for geerlingguy.postgresql
    - name: make shure libpq-dev is installed
      apt:
        name: libpq-dev
        update_cache: yes
        cache_valid_time: 3600
    - name: Make sure psycopg2 is installed
      pip:
        name: psycopg2
        state: present
  roles:
    - nginx
    - geerlingguy.redis
    - role: geerlingguy.postgresql
      become: yes
    - geerlingguy.ruby
    - geerlingguy.nodejs
    - greenlight

- name: Monitoring
  hosts: monitoring
  become: yes
  tags:
    - monitoring
  vars_files:
    - vars.yml
  vars:
    nginx_ipv4: "{{ web_ipv4 }}"
    nginx_ipv6: "{{ web_ipv6 }}"
    nginx_config_name: "monitoring"
    nginx_domain: "{{ mon_hostname }}"
    prometheus_targets:
      node:
      - targets:
          "{{ groups['all'] | map('extract', hostvars, ['ansible_fqdn']) | map('regex_replace', '$', ':9100') | list }}"
      process:
      - targets:
          "{{ groups['all'] | map('extract', hostvars, ['ansible_fqdn']) | map('regex_replace', '$', ':9256') | list }}"
      bbb:
      - targets:
          "{{ groups['bbb'] | map('extract', hostvars, ['ansible_fqdn']) | map('regex_replace', '$', ':9688') | list }}"
    prometheus_scrape_configs:
      - job_name: "prometheus"
        metrics_path: "/metrics"
        static_configs:
          - targets:
            - "127.0.0.1:9090"
      - job_name: "node"
        file_sd_configs:
          - files:
            - "/etc/prometheus/file_sd/node.yml"
        relabel_configs:
          - source_labels: ['__address__']
            separator:     ':'
            regex:         '(.*):.*'
            target_label:  'instance'
            replacement:   '$1'
      - job_name: "process"
        file_sd_configs:
          - files:
              - "/etc/prometheus/file_sd/process.yml"
        relabel_configs:
          - source_labels: [ '__address__' ]
            separator: ':'
            regex: '(.*):.*'
            target_label: 'instance'
            replacement: '$1'
      - job_name: "bbb"
        file_sd_configs:
          - files:
            - "/etc/prometheus/file_sd/bbb.yml"
        relabel_configs:
          - source_labels: ['__address__']
            separator:     ':'
            regex:         '(.*):.*'
            target_label:  'instance'
            replacement:   '$1'
    grafana_address: 127.0.0.1
    grafana_port: 3001
    grafana_url: "https://{{ mon_hostname }}"
    grafana_domain: "{{ mon_hostname }}"
    grafana_database:
      type: postgres
      host: 127.0.0.1:5432
      name: grafana
      user: grafana
      password: "{{ monitoring_grafana_postgres_password }}"
    grafana_datasources:
      - name: prometheus
        type: prometheus
        access: proxy
        url: 'http://localhost:9090'
        basicAuth: false
        isDefault: true
    grafana_dashboards_dir: files/grafana/dashboards
    grafana_security:
      admin_user: admin@ori.schuledigital.com
      admin_password: '{{ monitoring_grafana_admin_password }}'
    grafana_users:
      allow_sign_up: false
      default_theme: dark
      auto_assign_org: true
      editors_can_admin: true
      auto_assign_org_role: Editor
      org_name: ORI
    grafana_auth:
      disable_login_form: yes
      anonymous:
        enabled: true
        org_name: ORI
        org_role: Viewer
      generic_oauth:
        enabled: true
        name: ORI-Cloud
        allow_sign_up: true
        client_id: "{{ monitoring_client_id }}"
        client_secret: "{{ monitoring_client_secret }}"
        scopes: user:email,read:org
        auth_url: https://ori.schuledigital.com/index.php/apps/oauth2/authorize
        token_url: https://ori.schuledigital.com/index.php/apps/oauth2/api/v1/token
        api_url: https://ori.schuledigital.com/ocs/v2.php/cloud/user?format=json
        email_attribute_path: ocs.data.email
        role_attribute_path: contains(ocs.data.groups[*], 'admin') && 'Admin' || 'Viewer'
    grafana_smtp:
      enabled: true
      host: "{{ greenlight_mail.server }}:{{ greenlight_mail.port }}"
      user: "{{ greenlight_mail.user }}"
      password: "{{ greenlight_mail_password }}"
      from_address: "{{ greenlight_mail.sender }}"
      startTLS_policy: "MandatoryStartTLS"
    grafana_plugins:
      - grafana-image-renderer
    grafana_unsigned_plugins:
      - grafana-image-renderer
    postgresql_hba_entries:
      - { type: local, database: all, user: postgres, auth_method: peer }
      - { type: local, database: all, user: all, auth_method: peer }
      - { type: host, database: all, user: all, address: '127.0.0.1/32', auth_method: md5 }
      - { type: host, database: all, user: all, address: '::1/128', auth_method: md5 }
    postgresql_users:
      - name: grafana
        state: present
        password: "{{ monitoring_grafana_postgres_password }}"
    postgresql_databases:
      - name: grafana
        owner: grafana
        state: present
  pre_tasks:
    # needed for grafana-image-renderer
    - name: Install dependencies for grafana-image-renderer
      apt:
        name:
          - libxcomposite1
          - libnss3
          - libatk-bridge2.0-0
          - libgtk-3-0
          - libasound2
          - libxss1
        update_cache: yes
        cache_valid_time: 3600
        state: present
  roles:
    - role: geerlingguy.postgresql
      become: yes
    - cloudalchemy.prometheus
    - prometheus-ufw
    - cloudalchemy.grafana
    - nginx
    - grafana