#
# This is a base koji_builder role.
#
- name: set hostname
  hostname: name="{{inventory_hostname}}"
  tags:
  - koji_builder

- name: set root passwd
  user: name=root password={{ builder_rootpw }} state=present
  tags:
  - koji_builder
  - rootpw

- name: add mock user as 425
  user: name=mock uid=425 state=present home=/var/lib/mock createhome=yes system=yes
  tags:
  - koji_builder

- name: make mock homedir perms
  file: state=directory path=/var/lib/mock mode=2775 owner=root group=mock
  tags:
  - koji_builder

- name: add mock ssh dir
  file: state=directory path=/var/lib/mock/.ssh mode=700 owner=mock group=mock
  tags:
  - koji_builder

- name: add mock ssh keys
  copy: src=mock_auth_keys dest=/var/lib/mock/.ssh/authorized_keys mode=640 owner=mock group=mock
  tags:
  - koji_builder

- name: add kojibuilder
  user: name=kojibuilder groups=mock
  tags:
  - koji_builder

- name: add mockbuilder
  user: name=mockbuilder groups=mock
  tags:
  - koji_builder

- name: mockbuilder .ssh dir
  file: state=directory path=/home/mockbuilder/.ssh mode=700 owner=mockbuilder group=mockbuilder
  tags:
  - koji_builder

- name: mockbuilder ssh key
  copy: src=ftbfs_auth_keys dest=/home/mockbuilder/.ssh/authorized_keys mode=644 owner=mockbuilder group=mockbuilder
  tags:
  - koji_builder

- name: make a bunch of dirs
  file: state=directory path={{ item }}
  with_items:
    - /pub
    - /mnt/fedora_koji
    - /pub/fedora
    - /pub/epel
  tags:
  - koji_builder

- name: Install packages needed by koji_builders
  package:
    state: present
    name:
    - koji-builder
    - koji-builder-plugins
    - python3-koji
    - koji-containerbuild-builder
    - strace
    - mock
    - kernel-firmware
    - kernel-modules
    - rsyslog
    - audit
    - pycdio
    - python3-kickstart
    - libvirt-client
    - oz
    - imagefactory
    - imagefactory-plugins-TinMan
    - imagefactory-plugins-Docker
    - imagefactory-plugins-GCE
    - imagefactory-plugins-vSphere
    - imagefactory-plugins-ovfcommon
    - imagefactory-plugins
    - imagefactory-plugins-OVA
    - imagefactory-plugins-RHEVM
    - pykickstart
    - nosync
    - koji-osbuild-builder
    - ipset
  tags:
  - koji_builder
  - koji_builder_osbuild
#
# rpmautospec plugin
#

- name: install koji builder rpmautospec plugin
  package:
    name: "{{ item }}"
    state: present
  with_items:
  - koji-builder-plugin-rpmautospec
  tags:
  - packages
  - koji_builder
  - rpmautospec

- name: remove obsolete configuration of rpmautospec
  file:
    path: "/etc/kojid/plugins/{{ item }}"
    state: absent
  loop:
    - rpmautospec.conf
    - rpmautospec.conf.rpmnew
    - rpmautospec.conf.rpmsave
    - rpmautospec.conf.rpmorig
  tags:
  - koji_builder
  - rpmautospec

- name: install Flatpak builder plugin
  package: name=koji-flatpak-builder state=present
  tags:
  - koji_builder

- name: configure flatpak-builder plugin
  template: src=flatpak.conf dest=/etc/kojid/plugins/flatpak.conf
  vars:
    candidate_registry: "candidate-registry{{ env_suffix }}.fedoraproject.org"
  notify:
  - restart kojid
  tags:
  - koji_builder

- name: Install arm UEFI firmware package (aarch64 only)
  package: name=edk2-arm state=present
  tags:
  - koji_builder
  when: "ansible_architecture is defined and ansible_architecture == 'aarch64'"

- name: enable virtlogd service
  service: name=virtlogd state=started enabled=yes
  tags:
  - koji_builder

- name: build /etc/kojid/kojid.conf from group vars
  template: src=kojid.conf dest=/etc/kojid/kojid.conf
  notify:
  - restart kojid
  tags:
  - koji_builder
  - rpmautospec

- name: Create osbuild builder config directory
  file: path=/etc/koji-osbuild state=directory mode=0755
  tags:
  - koji_builder
  - koji_builder_osbuild

- name: build /etc/koji-osbuild/builder.conf
  template: src=builder.conf{{env_suffix}} dest=/etc/koji-osbuild/builder.conf
  notify:
  - restart kojid
  tags:
  - koji_builder
  - koji_builder_osbuild

- name: build /etc/koji/koji.conf from group vars
  template: src=koji.conf dest=/etc/koji.conf
  tags:
  - koji_builder

- name: config for the kojid runroot plugin (only some builders)
  template: src=runroot.conf.j2 dest=/etc/kojid/plugins/runroot.conf
  when: "'runroot' in group_names"
  notify:
  - restart kojid
  tags:
  - koji_builder

- name: override kojid.service file to set TasksMax to unlimited
  copy: src=kojid.service dest=/etc/systemd/system/kojid.service
  notify:
  - reload systemd
  - restart kojid
  tags:
  - koji_builder

# setup for oz/imagefactory
- name: make .psphere dir
  file: state=directory path=/root/.psphere mode=775 owner=root group=root
  tags:
  - koji_builder

- name: make .psphere/templates dir
  file: state=directory path=/root/.psphere/templates mode=775 owner=root group=root
  tags:
  - koji_builder

- name: copy over /root/.psphere/config.yaml
  copy: src={{ private }}/files/koji/config.yaml dest=/root/.psphere/config.yaml
  tags:
  - koji_builder
# done oz/imagefactory

- name: copy over /etc/security/limits.conf
  copy: src=limits.conf dest=/etc/security/limits.conf
  tags:
  - koji_builder

# oz.cfg  upstream ram and cpu definitions are not enough
- name: oz.cfg
  template: src=oz.cfg.j2 dest=/etc/oz/oz.cfg
  tags:
  - koji_builder
  - koji_builder/oz.cfg

# install libvirtd.conf
#
# This provides us with the ability to use virt-manager from non root accounts.
# This is useful in the oz/imagefactory context for debugging

- name: install libvirtd.conf
  copy: src="{{ files }}/virthost/libvirtd.conf" dest=/etc/libvirt/libvirtd.conf
  notify:
  - restart libvirtd
  tags:
  - koji_builder
  when: env != "staging"

#
# On primary we want to make a /mnt/koji link to /mnt/fedora_koji/koji
#

- name: make a mnt/koji link
  file: state=link src=/mnt/fedora_koji/koji dest=/mnt/koji
  when: koji_hub_nfs is defined and koji_hub_nfs == "fedora_koji" and createrepo == True
  tags:
  - koji_builder

- name: make a mnt/koji link
  file: state=link src=/mnt/fedora_koji/koji dest=/mnt/koji force=yes
  when: inventory_hostname.startswith(('buildvm-s390x-15', 'buildvm-s390x-16', 'buildvm-s390x-17'))
  tags:
  - koji_builder

#
# alternative arch builders however want to link to just /mnt/fedora_koji
#

- name: make a mnt/koji link
  file: state=link src=/mnt/fedora_koji dest=/mnt/koji
  when: koji_hub_nfs is defined and koji_hub_nfs != "fedora_koji" and createrepo == True
  tags:
  - koji_builder

- name: mock site-defaults.cfg
  template: src=builders/site-defaults.cfg dest=/etc/mock/site-defaults.cfg mode=0644 owner=root group=mock
  when: not inventory_hostname.startswith(('bkernel'))
  tags:
  - koji_builder
  - site-defaults

# x86_64 builders run both x86_64 and i686 builds, that requires multilib
# version of nosync installed to fully take advantage of nosync
- name: special pkgs for the x86_64 builders
  package:
    state: present
    name:
    - nosync.i686
  when: ansible_architecture == 'x86_64'
  tags:
  - koji_builder

# non-bkernel x86_64 builders run container_build, which needs osbs
- name: special pkgs for the x86_64 builders
  package:
    state: present
    name:
    - python3-osbs-client.noarch
  when: "ansible_architecture == 'x86_64' and not inventory_hostname.startswith('bkernel')"
  tags:
  - koji_builder

# Before, the builders had the "apache" role. This is a temporary play to remove the httpd daemon everywhere
- name: Uninstall httpd
  package: name=httpd
           state=absent
  tags:
  - koji_builder
  - removehttpd

- name: Add the Apache group
  group: name=apache
         gid=48
         system=yes
         state=present
  tags:
  - koji_builder
  - removehttpd

- name: Create the apache user
  user: name=apache
        uid=48
        createhome=no
        group=apache
        home=/usr/share/httpd
        shell=/sbin/nologin
        system=yes
        state=present
  tags:
  - koji_builder
  - removehttpd

- name: make sure we are in permissive selinux mode
  selinux: policy=targeted state=permissive
  tags:
  - koji_builder
  - selinux

- name: Create directory for shared secrets
  file:
    path: /etc/kojid/secrets
    state: directory
    owner: root
    group: root
    mode: 0660
  tags:
  - koji_builder
  when: env == "staging"

# https://pagure.io/fedora-infrastructure/issue/6636
- name: install libkcapi to get increased sockets on armv7
  dnf: name=libkcapi enablerepo=updates-testing state=present
  tags:
  - koji_builder
  when: ansible_architecture == 'armv7l'

# set highmem_is_dirtyable in compose armv7 machines.
# see: https://bugzilla.redhat.com/show_bug.cgi?id=1504264
#
- name: set highmem_is_dirtyable on armv7 builders that are in the compose channel.
  sysctl: name=vm.highmem_is_dirtyable value=1 state=present sysctl_set=yes reload=yes
  tags:
  - koji_builder
  when: inventory_hostname.startswith(('buildvm-armv7-01.arm', 'buildvm-armv7-02', 'buildvm-armv7-03'))

#
# Add rngd so that virtual maachines have enough randomness to boot in our lifetimes
#
- name: Install rng-tools for entropy
  package: name=rng-tools state=present
  tags:
  - koji_builder
  - koji_builder/rngd

- name: Start rngd
  service: name=rngd state=started enabled=yes
  tags:
  - koji_builder
  - koji_builder/rngd
  when: ansible_architecture != 's390x' and ansible_architecture != 'ppc64le'

- name: disable systemd-oomd we do not need or want it
  systemd: name=systemd-oomd state=stopped enabled=no masked=true
  tags:
  - koji_builder
  - koji_builder/oomd

- name: install script to update osbuild api ip in the firewall
  template: src=osbuildapi-update.sh dest=/usr/local/bin/osbuildapi-update.sh mode=755
  tags:
  - koji_builder
  - koji_builder/osbuildapi

- name: install cron job to run osbuild api ip update script every minute.
  template: src=osbuildapi-update.cron dest=/etc/cron.d/osbuildapi-update.cron mode=644
  tags:
  - koji_builder
  - koji_builder/osbuildapi

- name: create override dir for systemd-nspawn containers config
  file:
       state: directory
       owner: root
       group: root
       mode: 0755
       path: /etc/systemd/system/machine-.scope.d
  when: inventory_hostname.startswith(('buildhw-a64'))
  tags:
  - koji_builder
  - koji_builder/nspawn

- name: create override config for systemd-nspawn containers to allow coredumps
  template: src=nspawn-override.conf dest=/etc/systemd/system/machine-.scope.d/80-infra.conf mode=0644
  when: inventory_hostname.startswith(('buildhw-a64'))
  tags:
  - koji_builder
  - koji_builder/nspawn
