#
# Fedora Messaging Notifications (FMN)
#


- name: setup the database
  hosts: db01.iad2.fedoraproject.org:db01.stg.iad2.fedoraproject.org
  gather_facts: no
  become: yes
  become_user: postgres
  vars_files:
    - /srv/web/infra/ansible/vars/global.yml
    - /srv/private/ansible/vars.yml
    - /srv/web/infra/ansible/vars/{{ ansible_distribution }}.yml

  tasks:
    - name: FMN DB user
      postgresql_user:
        name: fmn
        password: "{{ (env == 'production')|ternary(fmn_prod_db_password, fmn_stg_db_password) }}"
    - name: FMN database creation
      postgresql_db:
        name: fmn
        owner: fmn
        encoding: UTF-8

- name: setup RabbitMQ
  hosts: rabbitmq[0]:rabbitmq_stg[0]
  user: root
  gather_facts: False

  vars_files:
    - /srv/web/infra/ansible/vars/global.yml
    - /srv/private/ansible/vars.yml
    - /srv/web/infra/ansible/vars/{{ ansible_distribution }}.yml

  roles:
    - role: rabbit/queue
      username: "fmn{{ env_suffix }}"
      queue_name: "fmn{{ env_suffix }}"
      routing_keys:
      # The FMN queue is subscribed to everything
        - "#"
      thresholds:
        warning: 20000
        critical: 25000
      # FMN sends messages when a rule is changed, to invalidate its cache
      sent_topics: ^org\.fedoraproject\.{{ env_short }}\.fmn\..*
      tags:
        - config
        - fedora-messaging
        - rabbitmq_cluster

    # FMN also has an internal VHost for communication between the consumer
    # (which listens to the Fedora Messaging bus on /pubsub) and the senders
    # (which send messages to the various destinations such as email, IRC,
    # Matrix).
    - role: rabbit/vhost
      vhost: /fmn
      tags:
        - config
        - fedora-messaging
        - rabbitmq_cluster

  tasks:
    - name: Grant the fmn user access to the fmn vhost
      rabbitmq_user:
        user: "fmn{{ env_suffix }}"
        vhost: /fmn
        configure_priv: .*
        read_priv: .*
        write_priv: .*
        # We have to repeat the topic permissions here until this is fixed:
        # https://github.com/ansible-collections/community.rabbitmq/issues/156
        topic_permissions:
          - vhost: /pubsub
            read_priv: .*
            write_priv: ^org\.fedoraproject\.{{ env_short }}\.fmn\..*
      tags:
        - config
        - fedora-messaging
        - rabbitmq_cluster

    - name: Create the sending queues in the fmn vhost
      rabbitmq_queue:
        name: "{{ item }}"
        vhost: /fmn
        auto_delete: no
        durable: yes
        # message_ttl: 300000
        state: present
        login_user: admin
        login_password: "{{ (env == 'production')|ternary(rabbitmq_admin_password_production, rabbitmq_admin_password_staging) }}"
      with_items:
        - email
        - irc
        - matrix
      tags:
        - config
        - fedora-messaging
        - rabbitmq_cluster

- name: make the app be real
  hosts: os_control_stg:os_control
  user: root
  gather_facts: False

  vars_files:
    - /srv/web/infra/ansible/vars/global.yml
    - /srv/private/ansible/vars.yml
    - /srv/web/infra/ansible/vars/{{ ansible_distribution }}.yml

  vars:

  roles:
    - role: openshift/project
      app: fmn
      description: "Fedora Messaging Notifications"
      appowners:
        - abompard
        - ryanlerch
        - nphilipp
      tags:
        - apply-appowners

    - role: openshift/object
      app: fmn
      file: imagestream.yml
      objectname: imagestream.yml

    - role: openshift/object
      app: fmn
      template: buildconfig.yml
      objectname: buildconfig.yml

    - role: openshift/object
      app: fmn
      template: configmap.yml
      objectname: configmap.yml

    - role: openshift/object
      app: fmn
      file: service.yml
      objectname: service.yml

    # Routes
    - role: openshift/route
      app: fmn
      routename: frontend
      host: "notifications{{ env_suffix }}.fedoraproject.org"
      servicename: frontend
      serviceport: web
      annotations:
        haproxy.router.openshift.io/timeout: 5m
    - role: openshift/route
      app: fmn
      routename: api
      host: "fmn-api.apps.ocp{{ env_suffix }}.fedoraproject.org"
      servicename: api
      serviceport: web
      annotations:
        haproxy.router.openshift.io/timeout: 5m
    # Sendria is an email sink for testing, to avoid sending actual emails.
    - role: openshift/route
      app: fmn
      routename: sendria
      host: "fmn-email.apps.ocp{{ env_suffix }}.fedoraproject.org"
      servicename: sendria
      serviceport: web
      annotations:
        haproxy.router.openshift.io/timeout: 5m
      when: env == "staging"

    # Secrets
    - role: openshift/object
      app: fmn
      template: secrets.yml
      objectname: secrets.yml

    - role: openshift/object
      app: fmn
      template: secret-webhook.yml
      objectname: secret-webhook.yml

    # Fedora Messaging
    - role: openshift/secret-file
      app: fmn
      secret_name: fedora-messaging-ca
      key: cacert.pem
      privatefile: "rabbitmq/{{env}}/pki/ca.crt"
    - role: openshift/secret-file
      app: fmn
      secret_name: fedora-messaging-crt
      key: fmn-cert.pem
      privatefile: "rabbitmq/{{env}}/pki/issued/fmn{{env_suffix}}.crt"
    - role: openshift/secret-file
      app: fmn
      secret_name: fedora-messaging-key
      key: fmn-key.pem
      privatefile: "rabbitmq/{{env}}/pki/private/fmn{{env_suffix}}.key"

    # Deployment config
    - role: openshift/object
      app: fmn
      template: deploymentconfig.yml
      objectname: deploymentconfig.yml

    # FASJSON access
    - role: openshift/ipa-client
      app: fmn
    - role: openshift/keytab
      app: fmn
      key: service.keytab
      secret_name: keytab
      service: fmn

    # Cron jobs
    - role: openshift/object
      app: fmn
      template: cron.yml
      objectname: cron.yml
