# This is mostly following
# http://taigaio.github.io/taiga-doc/dist/setup-production.html#circus-and-gunicorn
#
# It is just for dev/testing.. we're installing stuff from git/pip, etc..
#

- dnf: name={{item}} state=present
  with_items:
  - postfix
  - cronie
  - nginx
  - libsemanage-python
  - postgresql-server
  # Need this to use the postgresql ansible module
  - python-psycopg2

  - python3-gunicorn
  - python3-psycopg2
  # So we don't have to rebuild them in the virtualenv
  - python3-cairo
  - python3-cryptography
  - python3-pyOpenSSL
  - gettext

  - git
  - python3
  - python3-devel
  - python3-pip
  - redhat-rpm-config
  - gcc
  - freetype-devel
  - libxml2-devel
  - libxslt-devel
  - libjpeg-turbo-devel
  - postgresql-devel
  # To build the frontend
  - npm
# need this for letsencrypt cert
  - certbot
  - python3-certbot-nginx
  tags: taiga

- user: name=taiga comment="Taiga System Account"
  tags: taiga

### Real quick, let's setup postfix for mail on the side.
### if we ever move this internally, we'll just use bastion.
- name: Set postfix to run on boot
  service: name=postfix state=started enabled=yes
  tags: taiga

### FIRST, there is a lot of postgres db stuff to setup ###
- name: Initialize postgres if necessary
  command: /usr/bin/postgresql-setup initdb
           creates=/var/lib/pgsql/data/base
  notify: restart postgresql
  tags: taiga

- name: Add our postgres config file.
  copy: >
    src=pg_hba.conf
    dest=/var/lib/pgsql/data/pg_hba.conf
    owner=postgres
  notify: restart postgresql
  tags: taiga

# No need to let postgres talk to the world, right?
#- name: Let postgresql listen to '*'
#  command: sed -i -e "s|#listen_addresses = 'localhost'|listen_addresses = '*'|" /var/lib/pgsql/data/postgresql.conf
#  notify: restart postgresql
#  tags: taiga

- name: Ensure postgres has a place to backup to
  file: dest=/backups state=directory owner=postgres
  tags: taiga

- name: Copy over backup scriplet
  copy: src=backup-database dest=/usr/local/bin/backup-database mode=0755
  tags: taiga

- name: Set up some cronjobs to backup databases as configured
  template: >
    src=cron-backup-database
    dest=/etc/cron.d/cron-backup-database-{{ item }}
  with_items:
  - taiga
  tags: taiga

- name: Set postgresql-server to run on boot
  service: name=postgresql state=started enabled=yes
  tags: taiga

# Make sure we have db users
- postgresql_user: name=taiga
  # password={{ taiga_db_pass }}
  tags: taiga

- postgresql_db: name=taiga owner=taiga encoding=UTF-8
  tags: taiga
### DONE with db stuff


- become: yes
  become_user: taiga
  tags: taiga
  block:

  # Create the python virtualenv
  - name: setup the virtualenv
    pip:
      name: pip
      state: latest
      chdir: /srv/taiga
      virtualenv: /srv/taiga/venv
      virtualenv_command: pyvenv
      virtualenv_site_packages: yes

  - name: install Gunicorn
    pip:
      name: gunicorn
      virtualenv: /srv/taiga/venv

  # Install our plugin for the backend first
  - name: install the OIDC auth plugin
    git:
      dest: /srv/taiga/taiga-contrib-oidc-auth
      repo: https://github.com/fedora-infra/taiga-contrib-oidc-auth.git
    tags: taiga

  - pip:
      name: .
      editable: yes
      chdir: /srv/taiga/taiga-contrib-oidc-auth/back
      virtualenv: /srv/taiga/venv
    tags: taiga

  # setup taiga-back from git
  - git:
      repo: https://github.com/taigaio/taiga-back.git
      dest: /srv/taiga/taiga-back
      version: "{{taiga_back_version}}"
      # We modify the requirements.txt, we need to force here.
      force: yes

  - name: remove some versionned dependencies
    replace:
      path: /srv/taiga/taiga-back/requirements.txt
      regexp: '^(CairoSVG|cryptography)==.*$'
      replace: '\1'

  - name: install taiga-back dependencies
    pip:
      requirements: /srv/taiga/taiga-back/requirements.txt
      virtualenv: /srv/taiga/venv
    tags: taiga

- name: copy in our taiga backend config
  template: src=local.py dest=/srv/taiga/taiga-back/settings/local.py
            mode=0640 owner=taiga group=taiga
  notify: restart taiga-back
  tags: taiga

- name: copy in our taiga backend URLs config
  copy: src=urls.py dest=/srv/taiga/taiga-back/settings/urls.py
            mode=0640 owner=taiga group=taiga
  notify: restart taiga-back
  tags: taiga

- file: dest=/srv/taiga/taiga-back/locale state=directory
        owner=taiga group=taiga
  tags: taiga

  # change default admin password
- name: copy in our initial_user fixture
  template: src=initial_user.json dest=/srv/taiga/initial_user.json
            mode=0640 owner=taiga group=taiga
  tags: taiga

- become: yes
  become_user: taiga
  tags: taiga
  block:

  - django_manage:
      app_path: /srv/taiga/taiga-back
      virtualenv: /srv/taiga/venv
      command: migrate

  - django_manage:
      app_path: /srv/taiga/taiga-back
      virtualenv: /srv/taiga/venv
      command: loaddata
      fixtures: /srv/taiga/initial_user.json initial_project_templates

  - django_manage:
      app_path: /srv/taiga/taiga-back
      virtualenv: /srv/taiga/venv
      command: compilemessages

  - django_manage:
      app_path: /srv/taiga/taiga-back
      virtualenv: /srv/taiga/venv
      command: collectstatic
  ### DONE with taiga-back

  ### Setup taiga-front-dist from git
  - git:
      repo: https://github.com/taigaio/taiga-front-dist.git
      dest: /srv/taiga/taiga-front-dist
      version: "{{taiga_front_version}}"

- name: install the frontend configuration file
  template:
    src: conf.json
    dest: /srv/taiga/taiga-front-dist/dist/conf.json
    mode: 0644
    owner: taiga
    group: taiga
  tags: taiga

# create plugins directory - new in taiga 3.0.0
- file: dest=/srv/taiga/taiga-front-dist/dist/plugins state=directory owner=taiga group=taiga
  tags: taiga

# Build the frontend
# npm config set strict-ssl false
# npm install
# npm install gulp
# ./node_modules/.bin/gulp build

- become: yes
  become_user: taiga
  tags: taiga
  block:

  # Build our plugin
  - npm:
      path: /srv/taiga/taiga-contrib-oidc-auth/front
  - npm:
      path: /srv/taiga/taiga-contrib-oidc-auth/front
      name: gulp
  - command: ./node_modules/.bin/gulp build
    args:
      chdir: /srv/taiga/taiga-contrib-oidc-auth/front
      creates: /srv/taiga/taiga-contrib-oidc-auth/front/dist/oidc_auth.js

- name: copy the Fedora logo
  copy:
    src: fedora-logo.png
    dest: /srv/taiga/taiga-front-dist/dist/plugins/oidc-auth/images/contrib/fedora-logo.png
    owner: taiga
    group: taiga
  tags: taiga

- name: link our plugin pieces in place
  file: src=/srv/taiga/taiga-contrib-oidc-auth/front/dist
        dest=/srv/taiga/taiga-front-dist/dist/plugins/oidc-auth
        state=link
        owner=taiga
        group=taiga
  tags: taiga

- name: set selinux labels
  file:
    path: "/srv/taiga/{{ item }}"
    state: directory
    setype: httpd_sys_content_rw_t
    recurse: yes
  with_items:
  - taiga-front-dist/dist
  - taiga-back/static
  - taiga-back/media

### DONE with taiga-front


## taiga-back service
- name: copy systemd service file in for taiga
  copy: src=taiga-back.service dest=/usr/lib/systemd/system/taiga-back.service
  notify: reload systemd service files
  tags: taiga

- name: set taiga-back to start
  service: name=taiga-back state=started enabled=yes
  tags: taiga


# Letsencrypt

- name: get the letsencrypt cert
  command: certbot certonly -n --standalone --pre-hook "systemctl stop nginx" --post-hook "systemctl start nginx" -d {{ inventory_hostname }} --agree-tos --email admin@fedoraproject.org
  args:
    creates: "/etc/letsencrypt/live/{{ inventory_hostname }}/fullchain.pem"
  notify: restart nginx

- name: copy cert renew script
  copy: src=renew-cert.sh dest=/usr/local/bin/renew-cert.sh mode=0755
  tags:
  - taiga
  - cron
  - letsencrypt

- name: install cron for cert renewal
  copy: src=cron-renew-cert dest=/etc/cron.d/cron-renew-cert
  notify: restart crond
  tags:
  - taiga
  - cron


### FINALLY, nginx to serve/proxy it all
- template: src=default.nginx dest=/etc/nginx/default.d/taiga.conf
            mode=0644 owner=nginx group=nginx
  notify: restart nginx
  tags:
  - taiga
  - nginx
- template: src=taiga-ssl.nginx dest=/etc/nginx/conf.d/taiga-ssl.conf
        mode=0644 owner=nginx group=nginx
  notify: restart nginx
  tags:
  - taiga
  - nginx

# Add nginx to the taiga group so it gets rights to read all our static stuff
- user: name=nginx groups=taiga append=yes
  tags: taiga
- file: dest=/srv/taiga mode=0750
  tags: taiga
- seboolean: name="{{item}}" state=true persistent=true
  with_items:
  # So we can read static content at all
  - httpd_read_user_content
  # So we can follow the symlink to our FAS plugin
  - httpd_enable_homedirs
  # So we can reverse proxy stuff locally to gunicorn
  - httpd_can_network_connect
  tags: taiga

- service: name=nginx state=started enabled=yes
  tags: taiga
