path: root/ansible/radicle.liw.fi.yml

- hosts: radicle.liw.fi
  remote_user: root
  become: yes
  roles:
    - role: sane_debian_system
    - role: sshd
    - role: comfortable-debian-system
    - role: unix_users
    - role: rust-rustup
    - role: liw
  tasks:
    - name: "install important additional packages"
      apt:
        name:
          - caddy
          - moreutils
          - nmap
          - ripgrep

    - name: "install Caddy configuration"
      copy:
        content: |
          :80 {
                  root * /usr/share/caddy
          }
          radicle.liw.fi:443 {
                  reverse_proxy 127.0.0.1:8888
          }
          ci.radicle.liw.fi:443 {
                  root * /srv/http/
                  file_server browse
          }
        dest: /etc/caddy/Caddyfile

    - name: "create directory for CI logs"
      file:
        state: directory
        path: /srv/http
        owner: liw
        group: liw

    - name: "restart Caddy"
      systemd:
        name: caddy
        state: restarted
        masked: no
        enabled: yes
        daemon_reload: yes

    - name: "install radicle using installer"
      shell: |
        curl -sSf https://radicle.xyz/install | sudo -u liw bash

    - name: "create directory for Radicle keys"
      file:
        state: directory
        path: /home/liw/.radicle/keys
        owner: liw
        group: liw

    - name: "install Radicle private key"
      copy:
        content: |
          {{ lookup('pipe', 'pass show radicle/radicle.liw.fi/key') }}
        dest: /home/liw/.radicle/keys/radicle
        owner: liw
        group: liw
        mode: 0600

    - name: "install Radicle public key"
      copy:
        content: |
          {{ lookup('pipe', 'pass show radicle/radicle.liw.fi/key.pub') }}
        dest: /home/liw/.radicle/keys/radicle.pub
        owner: liw
        group: liw
        mode: 0644

    - name: "install systemd unit for Radicle node"
      copy:
        content: |
          [Unit]
          After=syslog.target network.target
          Description=Radicle Node

          [Service]
          Type=simple
          ExecStart=/home/liw/.radicle/bin/radicle-node --listen 0.0.0.0:8776
          Environment=RAD_HOME=/home/liw/.radicle
          KillMode=process
          Restart=never
          RestartSec=1
          User=liw
          Group=liw

          [Install]
          WantedBy=default.target
        dest: /lib/systemd/system/radicle-node.service

    - name: "enable systemd unit for Radicle node"
      systemd:
        name: radicle-node
        state: restarted
        masked: no
        enabled: yes
        daemon_reload: yes

    - name: "install systemd unit for Radicle HTTPD"
      copy:
        content: |
          [Unit]
          After=syslog.target network.target
          Description=Radicle HTTPd

          [Service]
          Type=simple
          ExecStart=/home/liw/.radicle/bin/radicle-httpd --listen 127.0.0.1:8888
          Environment=RAD_HOME=/home/liw/.radicle
          KillMode=process
          Restart=always
          RestartSec=1
          User=liw
          Group=liw

          [Install]
          WantedBy=default.target
        dest: /lib/systemd/system/radicle-httpd.service

    - name: "enable systemd unit for Radicle node"
      systemd:
        name: radicle-httpd
        state: restarted
        masked: no
        enabled: yes
        daemon_reload: yes

    - name: "install script to install Radicle CI stuff"
      copy:
        content: |
          #!/bin/bash
          set -xeuo pipefail

          clone_install() {
                  local url dir root
                  url="$1"
                  dir="$2"
                  root="$3"

                  if [ ! -e "$dir" ]; then
                          git clone "$url" "$dir"
                  else
                          (cd "$dir" && git pull)
                  fi

                  (cd "$dir" && cargo install --path=. --root="$root")
          }

          clone_install git://git.liw.fi/radicle-ci-broker radicle-ci-broker "$(pwd)/root"
          clone_install git://git.liw.fi/radicle-native-ci radicle-native-ci "$(pwd)/root"

          install root/bin/* $HOME/bin
        dest: /home/liw/install-radicle-ci
        owner: liw
        group: liw
        mode: 0755

    - name: "install Radicle CI stuff"
      shell: |
        sudo -i -u liw bash -c 'cd /home/liw && install -d bin && ./install-radicle-ci'

    - name: "install systemd unit for Radicle node"
      copy:
        content: |
          [Unit]
          After=syslog.target network.target
          Description=Radicle Node

          [Service]
          Type=simple
          ExecStart=/home/liw/.radicle/bin/radicle-node --listen 0.0.0.0:8776
          Environment=RAD_HOME=/home/liw/.radicle
          KillMode=process
          Restart=never
          RestartSec=1
          User=liw
          Group=liw

          [Install]
          WantedBy=default.target
        dest: /lib/systemd/system/radicle-node.service

    - name: "enable systemd unit for Radicle node"
      systemd:
        name: radicle-node
        state: restarted
        masked: no
        enabled: yes
        daemon_reload: yes

    - name: "install Radicle CI broker config"
      copy:
        content: |
          default_adapter: native
          adapters:
            native:
              command: /home/liw/bin/radicle-native-ci
              env:
                RADICLE_NATIVE_CI: /home/liw/native-ci.yaml
          filters:
            - !Or
              - !And
                - !Repository "rad:zZnk3hS8C3WAhnv7mWcCUToCqpBs"
                - !AnyPatch
              - !And
                - !Repository "rad:z3gqcJUoA1n9HaHKufZs5FCSGazv5"
                - !AnyPatch
        dest: /home/liw/ci-broker.yaml
        owner: liw
        group: liw
        mode: 0644

    - name: "create state directory for Radicle native CI"
      file:
        state: directory
        path: /home/liw/native-ci.state
        owner: liw
        group: liw
        mode: 0755

    - name: "install Radicle native CI config"
      copy:
        content: |
          state: /srv/http
          log: /home/liw/native-ci.log
        dest: /home/liw/native-ci.yaml
        owner: liw
        group: liw
        mode: 0644

    - name: "install systemd unit for Radicle CI broker"
      copy:
        content: |
          [Unit]
          After=radicle-node.service
          Description=Radicle CI broker

          [Service]
          Type=simple
          Environment=RAD_HOME=/home/liw/.radicle
          Environment=PATH=/home/liw/bin:/home/liw/.cargo/bin:/home/liw/.local/bin:/home/liw/.radicle/bin:/bin:/sbin
          ExecStart=bash -c '/home/liw/bin/ci-broker /home/liw/ci-broker.yaml >> /srv/http/broker.log'
          KillMode=process
          Restart=never
          RestartSec=1
          User=liw
          Group=liw

          [Install]
          WantedBy=default.target
        dest: /lib/systemd/system/radicle-ci-broker.service

    - name: "enable systemd unit for Radicle CI broker"
      systemd:
        name: radicle-ci-broker
        state: restarted
        masked: no
        enabled: yes
        daemon_reload: yes

  vars:
    ansible_python_interpreter: /usr/bin/python3

    sane_debian_system_version: 2
    sane_debian_system_hostname: "{{ inventory_hostname }}"
    sane_debian_system_codename: bookworm
    sane_debian_system_timezone: Europe/Helsinki
    sane_debian_system_sources_lists:
      - repo: |
          deb http://security.debian.org/debian-security bookworm-security main contrib non-free

    unix_users_version: 2
    unix_users:
      - username: liw
        comment: Lars Wirzenius

    sshd_version: 1

    rustup_cargo_install: |
      starship