- hosts: seed.liw.fi
  remote_user: root
  become: yes
  roles:
    - role: sane_debian_system
    - role: sshd
    - role: unix_users
    - role: rust-rustup
    - role: radicle_node
  tasks:
    - name: "install convenience packages"
      apt:
        name:
          - jq
          - moreutils
          - psmisc
  vars:
    ansible_python_interpreter: /usr/bin/python3

    sane_debian_system_version: 2
    sane_debian_system_hostname: "{{ inventory_hostname }}"
    sane_debian_system_codename: bookworm
    sane_debian_system_timezone: Europe/Helsinki
    sane_debian_system_sources_lists:
      - repo: |
          deb http://security.debian.org/debian-security bookworm-security main contrib non-free
      - repo: deb http://apt.liw.fi/debian unstable main
        signing_key: "{{ apt_liw_fi_signing_key }}"

    unix_users_version: 2
    unix_users:
      - username: _rad
        comment: Radicle node

    sshd_version: 1

    radicle_node_version: 1
    radicle_node_key: "{{ lookup('pipe', 'pass radicle/seed.liw.fi/key') }}"
    radicle_node_key_pub: "{{ lookup('pipe', 'pass radicle/seed.liw.fi/key.pub') }}"
    radicle_node_connections:
      - nid: z6MkfXa53s1ZSFy8rktvyXt5ADCojnxvjAoQpzajaXyLqG5n
        host: radicle.liw.fi
        port: 8776
    radicle_node_repositories: []
    radicle_node_domain_name: seed.liw.fi
    radicle_node_ci_domain_name: ci.seed.liw.fi
    radicle_node_ci_broker_config: |
      status_page: /srv/http/status.json
      default_adapter: native
      adapters:
        native:
          command: /bin/radicle-native-ci
          env:
            RADICLE_NATIVE_CI: /home/_rad/native-ci.yaml
      filters:
        - !And
          - !Repository "rad:zZnk3hS8C3WAhnv7mWcCUToCqpBs"
          - !AnyPatch
    radicle_node_policy: allow
    radicle_node_scope: all

    rust_rustup_user: _rad