- name: Setup ufw port forwarding for VPNs subnets
  hosts: vps_servers
  become: true
  gather_facts: true
  tasks:
    - name: Install ufw
      ansible.builtin.apt:
        name: ufw
        state: present
        update_cache: true

    # - name: Configure ufw port forwarding
    #   ansible.builtin.lineinfile:
    #     path: '/etc/sysctl.conf'
    #     regexp: '^#?net.ipv4.ip_forward='
    #     line: 'net.ipv4.ip_forward=1'
    #     state: present
    #   notify: Reload sysctl

    - name: Configure ufw port forwarding
      ansible.builtin.copy:
        src: 'sysctl/99-ipv4-forward.conf'
        dest: '/etc/sysctl.d/99-ipv4-forward.conf'
        owner: root
        group: root
        mode: '0644'
      notify: Reload sysctl

    - name: Set ufw default forwarding policy
      ansible.builtin.lineinfile:
        path: '/etc/default/ufw'
        regexp: '^DEFAULT_FORWARD_POLICY='
        line: 'DEFAULT_FORWARD_POLICY="ACCEPT"'
        state: present
      notify: Reload ufw

    - name: Add postrouting nat
      ansible.builtin.blockinfile:
        path: '/etc/ufw/before.rules'
        insertbefore: '^\*filter'
        block: |
          # VPN NAT
          *nat
          :POSTROUTING ACCEPT [0:0]
          -A POSTROUTING -s 10.9.0.0/24 -o {{ public_ip_iface }} -j MASQUERADE
          -A POSTROUTING -s 10.8.0.0/24 -o {{ public_ip_iface }} -j MASQUERADE
          -A POSTROUTING -s 10.10.0.0/24 -o {{ public_ip_iface }} -j MASQUERADE
          COMMIT
          # END VPN NAT
      notify: Reload ufw

  handlers:
    - name: Reload sysctl
      ansible.builtin.command: sysctl -p /etc/sysctl.d/99-ipv4-forward.conf
      register: result
      changed_when: result.rc == 0

    - name: Reload ufw
      ansible.builtin.command: ufw reload
      register: result
      changed_when: result.rc == 0

- name: Setup strongswan
  hosts: vps_servers
  become: true
  gather_facts: true
  tasks:
    - name: Uninstall strongswan legacy packages if present
      ansible.builtin.apt:
        name:
          - strongswan-starter
          - strongswan-charon
        state: absent
        purge: true
        autoremove: true

    - name: Install strongswan with swanctl and vici
      ansible.builtin.apt:
        name:
          - charon-systemd
          - strongswan-swanctl
          - libcharon-extra-plugins
        state: present
        update_cache: true

    - name: Copy strongswan config
      ansible.builtin.template:
        src: 'strongswan/ra-tech.conf.j2'
        dest: '/etc/swanctl/conf.d/ra-tech.conf'
        owner: root
        group: root
        mode: '0644'

    - name: Copy strongswan dhcp module config
      ansible.builtin.template:
        src: 'strongswan/charon/dhcp.conf.j2'
        dest: '/etc/strongswan.d/charon/dhcp.conf'
        owner: root
        group: root
        mode: '0644'

    - name: Copy Root CA
      ansible.builtin.copy:
        src: 'strongswan/ca.pem'
        dest: '/etc/swanctl/x509ca/ca-crt.pem'
        owner: root
        group: root
        mode: '0644'

    - name: Copy keys
      ansible.builtin.copy:
        src: 'strongswan/keys/'
        dest: '/etc/swanctl/rsa/'
        owner: root
        group: root
        mode: '0640'

    - name: Copy certificates
      ansible.builtin.copy:
        src: 'strongswan/certs/'
        dest: '/etc/swanctl/x509/'
        owner: root
        group: root
        mode: '0644'
      notify:
        - Restart strongswan service

    - name: Configure ra0 iface
      ansible.builtin.script: 'strongswan/iface-ra0-up.sh'

    - name: Copy ra0 iface setup script
      ansible.builtin.copy:
        src: 'strongswan/iface-ra0-up.sh'
        dest: '/usr/local/bin'
        owner: root
        group: root
        mode: '0755'

    - name: Copy ra0 startup service
      ansible.builtin.copy:
        src: 'strongswan/iface-ra0.service'
        dest: '/etc/systemd/system/iface-ra0.service'
        owner: root
        group: root
        mode: '0644'
      notify:
        - Reload ra0 startup service

    - name: Ufw allow strongswan ports
      community.general.ufw:
        rule: allow
        proto: udp
        port: '{{ item }}'
      loop:
        - '500'
        - '4500'

    - name: Ufw allow from vpn subnet
      community.general.ufw:
        rule: allow
        proto: any
        src: '10.9.0.0/24'

  handlers:
    - name: Restart strongswan service
      ansible.builtin.systemd:
        name: strongswan
        state: restarted
        enabled: true

    - name: Reload ra0 startup service
      ansible.builtin.systemd:
        name: iface-ra0.service
        enabled: true
        daemon_reload: true

- name: Setup cloak
  hosts: vps_servers
  become: true
  tasks:
    - name: Create go download directory
      ansible.builtin.file:
        path: /opt/go
        state: directory
        mode: '0755'

    - name: Download go
      ansible.builtin.get_url:
        url: 'https://go.dev/dl/go1.26.0.linux-amd64.tar.gz'
        dest: '/opt/go/go1.26.0.linux-amd64.tar.gz'
        mode: '0644'
        timeout: 60

    - name: Unpack go
      ansible.builtin.unarchive:
        src: '/opt/go/go1.26.0.linux-amd64.tar.gz'
        dest: '/usr/local'
        remote_src: true

    - name: Install git and make
      ansible.builtin.apt:
        name:
          - git
          - make
        state: present
        update_cache: true

    - name: Clone cloak git repository
      ansible.builtin.git:
        repo: 'https://github.com/cbeuw/Cloak.git'
        dest: '/opt/git/Cloak'
        single_branch: true
        version: master

    - name: Build cloak
      community.general.make:
        chdir: '/opt/git/Cloak'
      environment:
        PATH: '{{ ansible_env.PATH }}:/usr/local/go/bin'

    - name: Setup cloak server
      ansible.builtin.copy:
        src: '/opt/git/Cloak/build/ck-server'
        remote_src: true
        dest: '/usr/local/bin'
        owner: 'root'
        group: 'root'
        mode: '0755'

    - name: Add cloak group
      ansible.builtin.group:
        name: cloak
        state: present

    - name: Add user for cloak
      ansible.builtin.user:
        name: cloak
        group: cloak
        state: present
        createhome: false

    - name: Create cloak directory
      ansible.builtin.file:
        path: '/etc/cloak'
        state: directory
        mode: '0755'

    - name: Setup cloak server configuration
      ansible.builtin.template:
        src: 'cloak/server.json.j2'
        dest: '/etc/cloak/server.json'
        owner: root
        group: cloak
        mode: '0644'

    - name: Create cloak server data dir
      ansible.builtin.file:
        path: '/opt/cloak'
        state: directory
        owner: cloak
        group: cloak
        mode: '0755'

    - name: Setup cloak systemd service
      ansible.builtin.copy:
        src: 'cloak/cloak.service'
        dest: '/etc/systemd/system/cloak.service'
        mode: '0644'
      notify: Reload cloak service

    - name: Ufw allow cloak port
      community.general.ufw:
        rule: allow
        port: '5691'
        proto: tcp

  handlers:
    - name: Reload cloak service
      ansible.builtin.systemd:
        name: cloak.service
        state: started
        enabled: false
        daemon_reload: true

- name: Setup openvpn server
  hosts: vps_servers
  become: true
  tasks:
    - name: Install openvpn server
      ansible.builtin.apt:
        name: openvpn
        state: present
        update_cache: true

    - name: Copy certificates
      ansible.builtin.copy:
        src: 'openvpn/certs/'
        dest: '/etc/openvpn/server/'
        owner: root
        group: root
        mode: '0640'

    - name: Copy openvpn config
      ansible.builtin.copy:
        src: 'openvpn/server.conf'
        dest: '/etc/openvpn/server/server.conf'
        owner: root
        group: root
        mode: '0644'
      notify:
        - Restart openvpn server

    - name: Ufw allow openvpn port
      community.general.ufw:
        rule: allow
        proto: tcp
        port: '5690'

    - name: Ufw allow from vpn subnet
      community.general.ufw:
        rule: allow
        proto: any
        src: '10.8.0.0/24'

  handlers:
    - name: Restart openvpn server
      ansible.builtin.systemd:
        name: openvpn-server@server
        state: restarted
        enabled: true

- name: Setup bind9
  hosts: vps_servers
  become: true
  tasks:
    - name: Install bind9
      ansible.builtin.apt:
        name: bind9
        state: present
        update_cache: true

    - name: Copy bind9 config
      ansible.builtin.copy:
        src: '{{ item }}'
        dest: '/etc/bind/'
        owner: root
        group: bind
        mode: '0644'
      loop:
        - 'bind9/named.conf.local'
        - 'bind9/named.conf.options'
        - 'bind9/named.conf.default-zones'
        - 'bind9/named.conf.root-hints'

    - name: Copy bind9 zones
      ansible.builtin.copy:
        src: 'bind9/zones/'
        dest: '/etc/bind/zones/'
        owner: root
        group: bind
        mode: '0644'
      notify:
        - Restart bind9

    - name: Ufw allow bind9 ports
      community.general.ufw:
        rule: allow
        name: Bind9

  handlers:
    - name: Restart bind9
      ansible.builtin.systemd:
        name: named
        state: restarted
        enabled: true
        daemon_reload: true

- name: Setup prometheus node exporter
  hosts: vps_servers
  become: true
  tasks:
    - name: Create node-exporter download directory
      ansible.builtin.file:
        path: /opt/node-exporter
        state: directory
        mode: '0755'

    - name: Download node exporter executable
      ansible.builtin.get_url:
        url: 'https://github.com/prometheus/node_exporter/releases/download/v1.10.2/node_exporter-1.10.2.linux-amd64.tar.gz'
        dest: '/opt/node-exporter/node_exporter-1.10.2.linux-amd64.tar.gz'
        mode: '0644'

    - name: Extract node_exporter
      ansible.builtin.unarchive:
        src: '/opt/node-exporter/node_exporter-1.10.2.linux-amd64.tar.gz'
        dest: '/usr/local/bin'
        remote_src: true
        include:
          - 'node_exporter-1.10.2.linux-amd64/node_exporter'
        extra_opts:
          - '--strip-components=1'

    - name: Add node-exporter group
      ansible.builtin.group:
        name: node_exporter
        state: present

    - name: Add user for node exporter
      ansible.builtin.user:
        name: node_exporter
        group: node_exporter
        state: present
        createhome: false

    - name: Setup node-exporter service
      ansible.builtin.copy:
        src: 'node-exporter/node-exporter.service'
        dest: '/etc/systemd/system/node-exporter.service'
        owner: root
        group: root
        mode: '0644'
      notify: Reload node-exporter

  handlers:
    - name: Reload node-exporter
      ansible.builtin.systemd:
        name: node-exporter
        state: started
        enabled: true
        daemon_reload: true

- name: Setup haproxy
  hosts: vps_servers
  become: true
  tasks:
    - name: Install haproxy
      ansible.builtin.apt:
        name: haproxy
        state: present
        update_cache: true

    - name: Create haproxy certs directory
      ansible.builtin.file:
        path: /etc/haproxy/certs/
        state: directory
        owner: root
        group: haproxy
        mode: '0755'

    - name: Copy server certificate and key
      ansible.builtin.copy:
        src: 'haproxy/64.188.58.223.pem'
        dest: '/etc/haproxy/certs/64.188.58.223.pem'
        owner: root
        group: haproxy
        mode: '0640'

    - name: Copy configuration
      ansible.builtin.copy:
        src: 'haproxy/haproxy.cfg'
        dest: '/etc/haproxy/haproxy.cfg'
        owner: root
        group: haproxy
        mode: '0644'
      notify: Restart haproxy

    - name: Allow ufw jenkins webhook port
      community.general.ufw:
        rule: allow
        port: '7777'
        proto: tcp

  handlers:
    - name: Restart haproxy
      ansible.builtin.systemd:
        name: haproxy
        state: restarted
        enabled: true

- name: Setup tiny proxy
  hosts: vps_servers
  become: true
  tasks:
    - name: Install tiny proxy
      ansible.builtin.apt:
        name: tinyproxy
        state: present
        update_cache: true

    - name: Configure tiny proxy
      ansible.builtin.copy:
        src: 'tinyproxy/tinyproxy.conf'
        dest: '/etc/tinyproxy/tinyproxy.conf'
        mode: '0644'
      notify: Restart tinyproxy

  handlers:
    - name: Restart tinyproxy
      ansible.builtin.systemd:
        name: tinyproxy
        state: restarted
        enabled: true