---
# Deploy common Crans configuration and tools
- hosts: server
  vars:
    # Debian mirror on adm
    debian_mirror: http://mirror.adm.crans.org/debian
    debian_components: |
      main{% if ansible_system_vendor != 'QEMU' %} non-free{% endif %}
    # TODO: non free should only be for SMTP and microcode on non VM/LXC

    # Backup password
    backuppc_rsyncd_passwd: "{{ vault_backuppc_rsyncd_passwd }}"

    # NTP servers
    # TODO get this list with re2o
    ntp_servers:
      - fy.adm.crans.org
      - charybde.adm.crans.org
      - silice.adm.crans.org
  roles:
    - debian-apt-sources
    - common-tools
    - rsync-client
    - ntp-client

# Plug LDAP on all servers
- hosts: server
  vars:
    # LDAP binding
    ldap_base: 'dc=crans,dc=org'
    ldap_master_ipv4: '10.231.136.19'
    ldap_local_replica_uri:
      - "ldpa://10.231.136.38"
      - "ldpa://10.231.136.4"
    ldap_master_uri: "ldap://{{ ldap_master_ipv4 }}"
    ldap_user_tree: "cn=Utilisateurs,{{ ldap_base }}"
    ldap_nslcd_bind_dn: "cn=nslcd,ou=service-users,{{ ldap_base }}"
    ldap_nslcd_passwd: "{{ vault_ldap_nslcd_passwd }}"

    # Group permissions
    ssh_allow_groups: ssh nounou apprenti cableur root

    # Scripts will tell users to go there to manage their account
    intranet_url: 'https://intranet.crans.org/'

    # SSH keys for root account to use when LDAP is broken
    ssh_pub_keys: "{{ vault_ssh_pub_keys }}"
  roles:
    - ldap-client

# Document servers
- hosts: voyager.adm.crans.org  # test only on voyager for now
  vars:
    moinmoin_user: "{{ vault_moinmoin_user }}"
    moinmoin_password: "{{ vault_moinmoin_password }}"
    moinmoin_base_url: https://wiki.crans.org/CransTechnique/LesServeurs
  roles:
    - moinmoin-server

# Deploy LDAP replica
- hosts: odlyd.adm.crans.org,soyouz.adm.crans.org,fy.adm.crans.org,thot.adm.crans.org
  roles: []  # TODO

# Playbook to deploy NFS
- hosts: crans_server,!odlyd.adm.crans.org
  roles: []  # TODO
