# create a new osbuild worker

- import_playbook: "/srv/web/infra/ansible/playbooks/include/virt-create.yml"
  vars:
    myhosts: "buildvm_osbuild_ppc64le:buildvm_osbuild_ppc64le_staging"

- name: make osbuild-worker
  hosts: buildvm_osbuild_ppc64le:buildvm_osbuild_ppc64le_staging
  user: root
  gather_facts: True

  vars_files:
    - /srv/web/infra/ansible/vars/global.yml
    - "{{ private }}/vars.yml"
    - /srv/web/infra/ansible/vars/{{ ansible_distribution }}.yml

  pre_tasks:
    - include_vars: dir=/srv/web/infra/ansible/vars/all/ ignore_files=README
    - import_tasks: "{{ tasks_path }}/yumrepos.yml"

  roles:
    - base
    - hosts
    - ipa/client
    - sudo
    - nagios_client

  handlers:
    - import_tasks: "{{ handlers_path }}/restart_services.yml"

  tasks:
    - name: Set up osbuild worker
      block:
        - name: Create temporary file for client secret
          local_action: ansible.builtin.tempfile state="file" prefix="osbuild_"
          # never report this as changed to make the playbook idempotent
          changed_when: false
          register: client_secret_tempfile

        - name: Put secret into the temporary file
          local_action: ansible.builtin.copy
            content="{{ osbuild_worker_authentication_client_secret }}"
            dest="{{ client_secret_tempfile.path }}"
            mode="440"
          # never report this as changed to make the playbook idempotent
          changed_when: false

        - name: Import role to configure osbuild-worker
          ansible.builtin.import_role:
            name: ansible-osbuild-worker
          vars:
            # rest of the vars are set in the appropriate group_vars
            osbuild_worker_authentication_client_secret_file: "{{ client_secret_tempfile.path }}"

      always:
        - name: Remove temporary file with client secret
          local_action: ansible.builtin.file path="{{ client_secret_tempfile.path }}" state=absent
          # never report this as changed to make the playbook idempotent
          changed_when: false
          when: client_secret_tempfile is defined and client_secret_tempfile.path is defined
