provision.yml

---
- hosts: all
  gather_facts: no
  tasks:
  - name: Read vars from secrets file
    include_vars: "{{ secrets_file }}"
    no_log: true
    tags:
     - always

- hosts: base
  gather_facts: yes
  become: true
  roles:
    - role: common
      tags: ['core', 'base', 'common']
    - role: rsyslog
      tags: ['core', 'base', 'rsyslog']
    - role: iptables
      when:
        - iptables_enable | bool
      tags: ['core', 'base', 'iptables']
    - role: selfsigned_certs
      when:
        - use_selfsigned_certs
      tags: ['core', 'base', 'selfsigned_certs']

- hosts: frontend
  become: true
  roles:
    - role: hosts
      when:
        - update_hosts_file
      tags: ['core', 'frontend', 'hosts']
    - role: httpd
      tags: ['core', 'frontend', 'httpd']
    - role: welcome
      when:
        - use_welcome_role
      tags: ['core', 'frontend', 'welcome']

- hosts: loadbalancer
  gather_facts: true
  become: true
  roles:
    - role: haproxy
      tags: ['core', 'loadbalancer', 'lb']
    - role: keepalived
      when:
        - inventory_hostname in groups['loadbalancer_ha']
      tags: ['core', 'loadbalancer', 'keepalived']
    - role: bind
      when:
        - inventory_hostname in groups['loadbalancer_ha']
      tags: ['core', 'loadbalancer', 'bind']

- hosts: db_mysql
  gather_facts: no
  become: true
  roles:
    - role: mysql
      when:
        - inventory_hostname in groups['storage']
      tags: ['core', 'db_mysql', 'mysql']
    - role: galera
      when:
        - inventory_hostname in groups['dbcluster']
      tags: ['core', 'db_mysql', 'galera']
    - role: keepalived
      when:
        - inventory_hostname in groups['dbcluster_nodes']
      tags: ['core', 'db_mysql', 'keepalived']
    - role: galera_create_users
      when:
        - inventory_hostname in groups['dbcluster']
      tags: ['core', 'db_mysql', 'galera', 'galera_create_users']

- hosts: mongo_servers
  gather_facts: yes
  become: true
  roles:
    - role: mongo
      tags: ['core', 'mongo']

- hosts: app_php
  gather_facts: no
  become: true
  roles:
    - role: php
      tags: ['core', 'app_php', 'php']
    - role: static
      when:
        - inventory_hostname not in groups['lifecycle']
      tags: ['app_php', 'static']
    - role: metadata
      when:
        - inventory_hostname not in groups['lifecycle']
      tags: ['app_php', 'static']
    - role: openconext-common
      tags: ['core', 'app_php', 'eb', 'profile']
    - role: engineblock
      when:
        - inventory_hostname not in groups['lifecycle']
      tags: ['core', 'app_php', 'eb']
    - role: lifecycle
      when:
        - inventory_hostname in groups['lifecycle']
      tags: ['app_php', 'lifecycle']
  handlers:
    - import_tasks: roles/httpd/handlers/main.yml

- hosts: app_java
  gather_facts: true
  become: true
  roles:
    - role: java
      tags: ['core', 'app_java', 'java']
    - role: shibboleth
      tags: ['core', 'app_java', 'shib']
  handlers:
    - import_tasks: roles/httpd/handlers/main.yml

# run -t springboot -e springboot_service_to_deploy=manage,voot to only install
# the manage and voot app. Both GUI as servers will be installed.
- hosts: java_apps
  become: true
  roles:
    - { role: springboot,       tags: ['core', 'springboot'] }

  handlers:
    - import_tasks: roles/httpd/handlers/main.yml

- hosts: app_php
  gather_facts: no
  become: true
  roles:
   - role: profile
     when:
       - inventory_hostname not in groups['lifecycle']
     tags: ['core', 'app_php', 'profile']
  handlers:
    - import_tasks: roles/httpd/handlers/main.yml

- hosts: elk
  gather_facts: true
  become: true
  roles:
    - role: elk
      tags: ['elk' ]

- hosts: stats
  gather_facts: true
  become: true
  roles:
    - role: influxdb
      tags: ['influxdb' ]
  handlers:
    - include_tasks: roles/httpd/handlers/main.yml

- hosts: stepuppapp
  become: true
  roles:
    - { role: stepupwebauthn,                            tags: ['stepupwebauthn','stepup' ] }
    - { role: stepupazuremfa,                            tags: ['stepupazuremfa', 'stepup'] }
    - { role: stepupmiddleware,                          tags: ['stepupmiddleware' , 'stepup'] }
    - { role: stepupgateway,                             tags: ['stepupgateway' , 'stepup'] }
    - { role: stepupselfservice,                         tags: ['stepupselfservice' , 'stepup'] }
    - { role: stepupra        ,                          tags: ['stepupra' , 'stepup'] }
    - { role: stepupgateway        ,                     tags: ['stepupgateway' , 'stepup'] }

- hosts: docker
  become: true
  roles:
    - { role: docker,     tags: ['docker' ] }
    - { role: invite,     tags: ['invite' ] }
    - { role: dashboard,  tags: ["dashboard"] }
    - { role: teams,      tags: ["teams"] }
    - { role: pdp,        tags: ["pdp"] }
    - { role: voot,       tags: ["voot"] }
    - { role: attribute-aggregation, tags: ["aa", "attribute-aggregation"] }
    - { role: mujina-idp, tags: ["mujina-idp"] }  
    - { role: oidc-playground, tags: ["oidc-playground"] }  
    - { role: myconext,    tags: ["myconext"] }  
    - { role: manage,    tags: ["manage"] }  
    - { role: oidcng,    tags: ["oidcng"] }  
    - { role: stats,      tags: ["stats"] }  
    - { role: diyidp,      tags: ["diyidp"] }  
    - { role: profile,      tags: ["profile"] }  
    - { role: lifecycle,      tags: ["lifecycle"] }  
    - { role: stepuptiqr, tags: ['stepuptiqr' , 'stepup'] }

- import_playbook: "{{ environment_dir }}/playbook.yml"