arma.yaml

---
- name: Install steamcmd and Arma
  hosts: arma

  vars:
    user: arma
    home: "/srv/{{ user }}"
    server: "{{ home }}/server"
    repodir: "{{ server }}/server-handling"
    link: "{{ server }}/link"
    armadir: "{{ server }}/base-installation"
    steam_dir: "{{ home }}/steamcmd"
    workshop_checker:
      mail: 'updatebot@zeusops.com'
      password: !vault |
        $ANSIBLE_VAULT;1.1;AES256
        38373165613865303133623438353339353262653635623432353465343166643235313462303536
        3066353631626235636565653933306261643231393064330a356463303438356162633739383966
        65313961353066333137616461346639336531323463353064306661626137393161343665393535
        3837336639666463320a666239306165626363643462623066643236636635623539623066356234
        30663036663966613137366339636331373739656638633661383462623263653064
      recipients:
      - gehock@zeusops.com
      - berger@zeusops.com
      webhook_secret: !vault |
        $ANSIBLE_VAULT;1.1;AES256
        37323666613639626433396633616566323839646563396632333638363430656361356231393931
        3834666133336532306536646533356433646437373038340a303663306331323735393263326634
        62383161646166353464323631663539306234643739353565303435306161373739343430306537
        3566373665313532620a646332306566366338353764613764346230613938366337613461373663
        33623739653864636532646533376636393234393061613430333535373265356637623034616233
        64653764363936336662303364363637616430646663663562333839643331623364373662313730
        65316638333962303962396338303937313161326531333065353932353636656462346665336236
        31396431636138656139363832626239363664643138343665363166666137333331356537326363
        3066

    webhook_url: 'https://discord.com/api/webhooks/{{ workshop_checker.webhook_secret }}'
    repos:
    - { name: server-handling, dest: "{{ repodir }}" }
    - { name: modlists, dest: "{{ repodir }}/modlists" }
    - { name: workshop-checker, dest: "{{ repodir }}/bin/internal/workshop-checker" }
    - { name: userconfig, dest: "{{ link }}/userconfig" }
    # The profiles repo gets modified every time the server runs -> can't be
    # pulled automatically because of local changes
    - { name: poseidon-profiles, dest: "{{ link }}/profiles", pull_updates: no }
    - { name: mod-preset-convert, dest: "{{ home }}/preset-convert" }
    # - { name: example, dest: "{{ home }}/repo", branch: test, pull_updates: no }
    ufw_apps:
    - { file: arma-server, app: Arma }
    symlinks:
    - { src: "{{ link }}", dest: "{{ home }}/link" }
    - { src: "{{ repodir }}/modlists", dest: "{{ home }}/modlists" }
    - { src: "{{ armadir }}", dest: "{{ home }}/arma3" }


  tasks:
  - name: Create mission upload group
    ansible.builtin.group:
      name: mission_upload
  - name: Create user
    ansible.builtin.user:
      name: "{{ user }}"
      system: yes
      home: "{{ home }}"
      shell: /bin/bash
      groups: mission_upload
      append: yes
  - name: Install rename
    ansible.builtin.apt:
      name: rename
      update_cache: yes

  # UFW
  # TODO: move into a role
  - name: Install UFW apps
    ansible.builtin.copy:
      src: "files/ufw/applications.d/{{ item.file }}"
      dest: "/etc/ufw/applications.d/{{ item.file }}"
    loop: "{{ ufw_apps }}"
  - name: Enable UFW rules
    community.general.ufw:
      rule: allow
      name: "{{ item.app }}"
    loop: "{{ ufw_apps }}"


  - name: Non-privileged tasks
    become: yes
    become_user: "{{ user }}"
    block:
    - name: Setup bashrc
      ansible.builtin.lineinfile:
        path: "{{ home }}/.bashrc"
        line: "{{ item }}"
      loop:
      - "PATH={{ repodir }}/bin:$PATH"
      - "export STEAM_DIR={{ steam_dir }}"
    - name: Set git configs
      community.general.git_config:
        scope: global
        name: "{{ item.config }}"
        value: "{{ item.value }}"
      loop:
      - { config: user.name,  value: Sami Laine }
      - { config: user.email, value: sami.v.laine@gmail.com }

    - name: Create SSH directory
      ansible.builtin.file:
        path: "{{ home }}/.ssh"
        state: directory
    - name: Install SSH dependency
      ansible.builtin.pip:
        name: stormssh
    - name: Generate SSH deploy keys
      community.crypto.openssh_keypair:
        type: ed25519
        path: "{{ home }}/.ssh/{{ item.name }}_deploy_key"
        comment: "{{ user }}@{{ ansible_hostname }}#{{ item.name }}"
      loop: "{{ repos }}"
      register: sshkey
    - name: Print keys
      when: sshkey.changed
      # TODO: format this in a more beautiful way
      debug:
        #msg: "{{ sshkey | json_query('results[*].[public_key, comment]') }}"
        msg: "SSH key: {{ item }}"
      loop: "{{ sshkey | json_query('results[*].[public_key, comment]') | json_query(\"[*].join(' ', @)\")  }}"
      loop_control:
        label: 'key'
    - name: Prompt to add deploy keys
      when: sshkey.changed
      ansible.builtin.pause:
        prompt: "add the above keys to GitHub before continuing"

    - name: Create SSH configs
      community.general.ssh_config:
        user: "{{ user }}"
        host: "github.com-{{ item.name }}"
        hostname: github.com
        identity_file: "{{ home }}/.ssh/{{ item.name }}_deploy_key"
      loop: "{{ repos }}"

    - name: Clone repos
      ansible.builtin.git:
        repo: "git@github.com-{{ item.name }}:zeusops/{{ item.name }}.git"
        dest: "{{ item.dest }}"
        accept_newhostkey: yes
        version: "{{ item.branch | d('main') }}"
        # Submodules are cloned manually because we want to set the SSH remote
        # address instead of HTTPS
        recursive: no
        update: "{{ item.pull_updates | d('yes') }}"
      loop: "{{ repos }}"
    - name: Install workshop-checker dependencies
      block:
      - name: Template requirements.txt
        ansible.builtin.template:
          src: files/arma/workshop-checker/requirements.txt.j2
          dest: "{{ home }}/workshop-checker-requirements.txt"
        #vars:
        #  repodir: "{{ repodir }}"
      - name: Pip install
        ansible.builtin.pip:
          requirements: "{{ home }}/workshop-checker-requirements.txt"
          virtualenv: "{{ repodir }}/bin/internal/workshop-checker/.venv"
    - name: Install preset-convert dependencies
      ansible.builtin.pip:
        requirements: "{{ home }}/preset-convert/requirements.txt"
        virtualenv: "{{ home }}/preset-convert/venv"

    - name: Create workshop-checker config
      ansible.builtin.template:
        src: files/arma/workshop-checker/secret.py.j2
        dest: "{{ repodir }}/bin/internal/workshop-checker/src/workshop_checker/secret.py"
        mode: '0600'
      vars:
        mail: "{{ workshop_checker.mail }}"
        password: "{{ workshop_checker.password }}"
        recipients: "{{ workshop_checker.recipients }}"
        #webhook_url: "{{ webhook_url }}"

    - name: Create Arma install directory
      ansible.builtin.file:
        path: "{{ armadir }}"
        state: directory

    - name: Symlink server-handling
      ansible.builtin.file:
        src: "{{ repodir }}"
        dest: "{{ item }}"
        state: link
      loop:
       - "{{ home }}/files"
       - "{{ server }}/files"
    - name: Other symlinks
      ansible.builtin.file:
        src: "{{ item.src }}"
        dest: "{{ item.dest }}"
        state: link
      loop: "{{ symlinks }}"

    - name: Set home permissions
      ansible.builtin.file:
        path: "{{ home }}"
        state: directory
        mode: "o+x"

    - name: Create mod install directory
      ansible.builtin.file:
        path: "{{ steam_dir }}/mods"
        state: directory

  - name: Privileged tasks
    block:
    - name: Create mpmissions and set permissions
      ansible.builtin.file:
        path: "{{ link }}/mpmissions"
        state: directory
        mode: 02770
        owner: "{{ user }}"
        group: mission_upload

    - name: Create cronjob to check main mod updates
      ansible.builtin.cron:
        name: Check for main mod updates
        cron_file: check-mod-upates
        minute: "*/15"
        user: "{{ user }}"
        job: "{{ repodir }}/bin/update-mods.sh main --check-only --notify --no-mail > /dev/null"

    - name: Create cronjob to check optional mod updates
      ansible.builtin.cron:
        name: Check for optional mod updates
        cron_file: check-optional-mod-upates
        minute: "*/15+5"
        user: "{{ user }}"
        job: "{{ repodir }}/bin/update-mods.sh optional --check-only --notify --no-mail 2>&1 > /dev/null | grep -v 2479229680"

    - name: Shut down antistasi before ops
      ansible.builtin.cron:
        name: Shut down antistasi before ops
        cron_file: shut-down-antistasi
        minute: "30"
        hour: 18
        weekday: "5,6,7"
        user: root
        job: "systemctl stop arma@antistasi"
        disabled: true
    - name: Start up antistasi after ops
      ansible.builtin.cron:
        name: Start up antistasi before ops
        cron_file: start-up-antistasi
        minute: "15"
        hour: 21
        weekday: "5,6,7"
        user: root
        job: "systemctl start arma@antistasi"
        disabled: true

    - name: Shut down sideop before ops
      ansible.builtin.cron:
        name: Shut down sideop before ops
        cron_file: shut-down-sideop
        minute: "30"
        hour: 18
        weekday: "5,6,7"
        user: root
        job: "systemctl stop arma@sideop"
    - name: Start up sideop after ops
      ansible.builtin.cron:
        name: Start up sideop before ops
        cron_file: start-up-sideop
        minute: "15"
        hour: 21
        weekday: "5,6,7"
        user: root
        job: "systemctl start arma@sideop"
        disabled: true

    - name: Install steamcmd
      import_role:
        name: lutangar.steamcmd
      vars:
        # FIXME: this doesn't actually override the variable as expected, had to
        # truncate vars/Debian.yml in the role for this to apply
        steamcmd_packages:
        - lib32gcc-s1
        steamcmd_create_user: no
        steamcmd_user: "{{ user }}"
        steamcmd_user_home: "{{ home }}/"
        steamcmd_directory: "{{ steam_dir }}/"
        steamcmd_steam:
          username: anonymous

    - name: Create Arma systemd service
      ansible.builtin.template:
        src: files/arma/systemd.service.j2
        dest: "/etc/systemd/system/{{ user }}@.service"
      vars:
        bin: "{{ repodir }}/bin"
        group: "{{ user }}"
        workdir: "{{ server }}/base-installation"
      notify:
      - Reload systemd
    - name: Enable Arma service
      ansible.builtin.service:
        #state: started
        enabled: yes
        name: "{{ user }}@main.service"
    - name: Create cronjob to start HCs
      ansible.builtin.cron:
        name: Start HCs after boot
        cron_file: start-hcs
        special_time: reboot
        user: root
        job: "sleep 120 ; for x in 1 2 3; do systemctl start {{ user }}@main-hc$x; sleep 5; done"
    - name: Create cronjob to back up Antistasi profile
      ansible.builtin.cron:
        name: Back up Antistasi profile
        cron_file: back-up-antistasi
        minute: "*/15"
        user: "{{ user }}"
        job: "cp ~{{ user }}/link/profiles/server/home/2023-12-29-antistasi/2023-12-29-antistasi.vars.Arma3Profile ~{{ user }}/antistasi-backup/backup_$(date -Iseconds).vars.Arma3Profile"
        disabled: true


  handlers:
  - name: Reload systemd
    become: yes
    become_user: root
    ansible.builtin.systemd:
      daemon_reload: yes