# @NOTE run 'ansible-playbook' command on this using 'sudo'
- name: Initialize VPS
  hosts: "{{ chosen_host | default('staging0.test') }}"
  remote_user: "{{ chosen_user | default('root') }}"
  vars:
    harden: true
  vars_files:
    - vars/local_facts.yml # REQUIRED
    - vars/vpn_settings.yml # REQUIRED
    - vars/wireguard_settings.yml # REQUIRED
    - vars/headscale_settings.yml # REQUIRED
    - vars/podpose_settings.yml # REQUIRED
    - vars/certbot_settings@vps.yml # REQUIRED
    - vars/users@{{ inventory_hostname | default('vps') }}.yml
    - vars/config@{{ inventory_hostname | default('vps') }}.yml
  tasks:
    - name: Hardening SSH server
      ansible.builtin.include_role:
        name: init-server  # required. The name of the role to be executed.
        # apply:  # not required. Accepts a hash of task keywords (e.g. C(tags), C(become)) that will be applied to all tasks within the included role.
        tasks_from: harden # not required. File to load from a role's C(tasks/) directory.
        # vars_from: main # not required. File to load from a role's C(vars/) directory.
        # defaults_from: main # not required. File to load from a role's C(defaults/) directory.
        # allow_duplicates: True # not required. Overrides the role's metadata setting to allow using a role more than once with the same parameters.
        # handlers_from: main # not required. File to load from a role's C(handlers/) directory.
    - name: Installing requisite packages
      ansible.builtin.include_role:
        name: init-server
        tasks_from: core@install-pkgs
        handlers_from: core
    - name: Initializing groups and users
      ansible.builtin.include_role:
        name: init-server
        tasks_from: ssh-users
    - name: Flushing handlers
      ansible.builtin.meta: flush_handlers
    - name: Updating hostname
      become: true
      ansible.builtin.hostname:
        name: "{{ fqdn | default(inventory_hostname) }}"
    - name: Updating hosts file
      become: true
      ansible.builtin.lineinfile:
        path: /etc/hosts
        regexp: "^127\\.0\\.1\\.1"
        line: "127.0.1.1  {{ fqdn | default(inventory_hostname) }}"
        insertbefore: BOF
        state: present
    - name: Updating host icon name
      become: true
      ansible.builtin.command:
        cmd: "hostnamectl set-icon-name computer-server"
    - name: Opening port 51820
      become: true
      ansible.builtin.iptables:
        chain: INPUT
        protocol: "{{ item }}"
        destination_port: 51820
        jump: ACCEPT
        comment: Open up port 51820
      loop:
        - udp
        - tcp
    - name: Opening port 443
      become: true
      ansible.builtin.iptables:
        chain: INPUT
        protocol: "{{ item }}"
        destination_port: 443
        jump: ACCEPT
        comment: Open up port 443
      loop:
        - udp
        - tcp
    - name: Opening ports
      become: true
      ansible.builtin.iptables:
        chain: INPUT
        protocol: tcp
        destination_port: "{{ item }}"
        jump: ACCEPT
        comment: "Open up port {{ (item | string) }}"
      loop:
        - 80
        - 465
        - 587
        - 995
        - 993
    - name: Notifying user that all processes have finished
      ansible.builtin.debug:
        msg: All processes finished. Hit enter to reboot machine.
    - name: Ensuring user has read prior message regarding upcoming reboot
      ansible.builtin.pause:
    - name: Rebooting machine for hostname change
      become: true
      ansible.builtin.reboot:
        msg: "Rebooting machine.."
        connect_timeout: 0
        test_command: ~