#!/usr/bin/ansible-playbook

- name: setup-buildd
  hosts: all
  become: true

  tasks:

  - name: packages
    apt:
      name:
      - acl # allow unprivileged users to read ansible's files
      - ca-certificates
      - debootstrap
      - default-jre-headless
      - dose-builddebcheck
      - dose-distcheck
      - dose-extra
      - etckeeper
      - ferm
      - git
      - hardlink
      - make
      - ncdu
      - newpid
      - postgresql-common # for apt.postgresql.org.sh
      - quilt
      - sbuild
      - schroot
      - sudo
      #- ubuntu-archive-keyring
      - vim
      - zstd

  - name: remove packages
    apt:
      name:
      - joe
      - nano
      state: absent

  - name: users
    user:
      name: '{{ item.user }}'
      comment: '{{ item.comment }}'
      groups: [ sudo, sbuild ]
      append: true
      shell: /bin/bash
    loop:
      - { user: mbanck, comment: 'Michael Banck' }
      - { user: mha, comment: 'Magnus Hagander' }
      - { user: mnencia, comment: 'Marco Nenciarini' }
      - { user: myon, comment: 'Christoph Berg' }
    tags: users

  - name: user authorized_keys
    authorized_key:
      user: '{{ item.user }}'
      key: '{{ item.key }}'
      state: "{{ item.state | default('present') }}"
    loop:
      - { user: mbanck, key: 'ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAllGcEhn6t6GxLlVzLmS7KlcnTpZxUJHKh9t5MavFBnZJ3NuPn9YI8hp/nMZLVEe077aLKsKchfQwhRTxUhePmk5NbcN2TZjsAqxzx8ivTzsSCWSx7HQN5ZaqWxDXDVymsNYbeN+wGWv7VCQHUlxJdV5S9ckesUE9u6j/hY0u3qTJEo6wM3xlbaPkV6Xty4Tkxc3FuJ71rFx4FPOJZXwNHYZTszoI4aD3eB2a6fDwmjDLZwts6/R66pUGy3MOt5NXR3ngrOqnOU3VYyy94VMlll17k97O6RmLH2ewJcFsDO6oLlXEUS7lcpnpbrHHpAKoOlvFbBL3OFPqHyMqlgBbXQ== mbanck@nighthawk' }
      - { user: mha, key: 'ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCBvMaccs/o+hr7+ISu07kYTDlTYW+iPg9avLf5muaCZbF30QvZZC08xowDysVpTPS2IHv/loVnXzi6ADaNtK05zj1XX8XJyP5cr5pJyQMq7IOG2KZwRy7VMlJDN1LRjRBEyZJYBlCnrDhgXq4+7usm+gLSd1hFqr+BSDEIJcLb6kITXCce5SpX2RXmcHPWYzCWd1C2Pk5rGZbJzEAlYVtF2XCC1FOYOuS5jrjHhOHz1ziCda23DEenT6/dittkW8YGfnyg831WD3QHrnCiPu+/DZRuH/qmAnHuhuU7DrRud37+eNYS/3GjqqMxsfb4LKXQbLPnXBxd21//e4En1Fv7 mha' }
      - { user: mnencia, key: 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOIkgpEFlxpWbSO4N9xC6ErSCW6DGVlDJk1AuBxQSZU4 mnencia' }
      - { user: myon, key: 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHFRKPQ20J39UyK6N1QjSCXK8ccr8g+fVVkYFMz1Z4ZP myon-keypair' }
      - { user: myon, key: 'ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQC81q2tweMIusbPk+V49U2Hhg52mY2FagTRBRf+Py5ktmYhIr8GF5/q+vfIVjZzy+iEQBdV41uTO6OQgw64lGFvavU88lOq/g6n/ooxlbOnt7tkMDMk9irG6CfUyyBOri3QJw+zFHwydvqytnLz/nMsOzdInLG6plYL5eeV12Lbao+6WCTQuk7UcFv8Mfn1++Od+6a2A0k0Tzw7Jcz0HgpRHN8RRME5mBAIV7Cb2KVenjPEuo7VARYBhI9U47fuVHWg6zbr8iacXPcwN3ac+x91avMymhYHfx11nAoMQvu8Pu5BTqHm5lWkI29VkFKmYpRExGuUc3R8xXbk8zgnlBkmQJGebVUwFPLK9wQx1ZLRmbYHub3GImKC7NYvA0u2dck2vxMx20cO6KXxNhRZfx7S00o5/I9O6I1wr0tvWsOYRYDAM8iHyPry85muJeI/JIWSf1j1JHSSTZO/2H2T4ZObZge9D6vtmfWjsLFCPxXcIXq4Zji82JI9gw0fmtnz7se+zYU1cGTm3wmMj2d5AhHl3TXAUOPvA7awRc97oRESumB9CgoJJ5mw1rXOP+U+82Qh/T5uoon708WSB2N4wzyAtkY1ePDWW5pGMKyO1aZ+2DGk1n+eDFCIeRj3r3+PCtsn6hEd9637KYDYDiixb7RqJh1Ev8ck7o20pBicyNdmbQ== cardno:000604626832 Christoph Berg Yubikey 1' }
      - { user: myon, key: 'ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQC5dMSoQkXdeaZmjVxGKqeBWfeCTmLlJ4gaDdz3u6a0GYwj40kUSWdwH1TkHAGcQCL550mEQMTmTS2ABb1oOg8r4UpUQ+pplypZF6D38ZHcEQhm/wd82NmtrbcHsRB2o1B4dQ67AJ+4gmlCuSM2wJJiqF/Z8Vj5WLphsXn7ORlLHoN63YaUrQfhpNfK5KtCKIyDGgQVxrjwemeUy9nBTUi9nOiXh55PoQJQA7HiEPrXXh1iuxzHDbM5LCA8Vdhm1d1jbTr1z718/tQrUMhz/LoBpKn85t0xvJYuQnP53u7TZHUWrLBHieqiABJqhOm9+dbVwOtyj0s4i1I7Dnt7ox1k7hYNWBjLZD14RjG4soQA2tBXExvIO3cs+IXQMGAkGITD1fTVYhfnsO88/jf9jYoLHvDi4nCVi2XK/Yccq28VBSsH5EspIHoiw1Ku2bJ/jnaM1JKfzzcOrPr5+hizO9sjPrJYbW3AkL6rTu8KMAQnmfX2Fo16xg7qxh1iE0cvLgfIYNPwAcDXrsKYv0thwTApPsf09H8w2v6gBC6Piy5DQnQ8/ZtHTfcxrA2t/D2vth4T11C2TRPt+T4SYZjw7jsi2bRB27kmfEv4q89L5irdu/m51M6qWbmdkvL0LY8fH2Vs6jSUpk8O5AM7JFgdZsezbCOMxhPQcLLsNhX/WZk89w== cardno:9 622 330 Christoph Berg Yubikey 2' }
    tags: users

  - name: apt.postgresql.org repository
    #shell: echo yes | /usr/share/postgresql-common/pgdg/apt.postgresql.org.sh -h atalia.postgresql.org -st
    shell: echo yes | /usr/share/postgresql-common/pgdg/apt.postgresql.org.sh
    args:
      creates: /etc/apt/sources.list.d/pgdg.sources

  - name: Deploy scripts
    copy:
      src: ../{{item}}
      dest: /usr/local/bin/{{item}}
      mode: 0755
    with_items:
      - netns-setup

  - name: allow sudo for sudo group
    lineinfile:
      line: '%sudo	ALL=(ALL:ALL) NOPASSWD: ALL'
      dest: /etc/sudoers
      regexp: '^%sudo'

  - name: buildd user
    user:
      name: buildd
      groups: sbuild,sudo
      shell: /bin/bash

  - name: buildd authorized_keys
    authorized_key:
      user: buildd
      key: 'ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDEbRuNmXd2MhrSN7RTINoj1kYZQ8iRKvhvGCE8jqgMj1UpKL8XGIiD3ouGqIYt1eDaDvMoSGEwYVYZHbkRz7U9Kpb2n7fenOhRTT9jkE4p4eYnYbhV81ZB487IiKBAkIyGk9+J6XbQO4dnLY+XDufGIKXkPwdYkw2otvxfSI+TjJQ7tRw4BHn9+UsPPKRYSO/i7d/jgZcthVWsRPdDk54dRI2uDClXob7rJjazCWPVBH8VDXbbM2q5xIgVAG812GXAXXksAljdQU05lwOgVo5foPVeV0SKnrVIugf4xmJXkNNtU1l62g5Whkqu9KMk1uzPpopSwyaGk7I0WftPU57J jenkins@pgdgbuild.dus.dg-i.net'

  - name: create chroot directory
    file:
      name: '{{chroot_dir}}'
      state: directory

  - name: symlink chroot directory from /home/chroot
    file:
      name: /home/chroot
      src: '{{chroot_dir}}'
      state: link
    when: 'chroot_dir != "/home/chroot"'

  - name: schroot sbuild fstab
    copy:
      src: fstab.sbuild
      dest: /etc/schroot/sbuild/fstab
      mode: 0644

  - name: schroot default fstab
    copy:
      src: fstab.default
      dest: /etc/schroot/default/fstab
      mode: 0644

  # make sure /etc/hosts is handled in copyfiles instead of nssdatabases
  - name: schroot copyfiles
    copy:
      src: schroot.copyfiles
      dest: /etc/schroot/{{item}}/copyfiles
      mode: 0644
    with_items:
      - default
      - sbuild
  - name: schroot nssdatabases
    copy:
      src: schroot.nssdatabases
      dest: /etc/schroot/{{item}}/nssdatabases
      mode: 0644
    with_items:
      - default
      - sbuild

  - name: /etc/default/schroot
    copy:
      src: schroot.default
      dest: /etc/default/schroot
      mode: 0644

  - name: sbuild lock directory
    file:
      state: directory
      dest: /run/lock/sbuild-package
      mode: 03775
      owner: buildd
      group: sbuild

  - name: sbuild.conf
    copy:
      src: sbuild.conf
      dest: /etc/sbuild/sbuild.conf
      mode: 0644

  - name: add /run to /etc/fstab
    lineinfile:
      dest: /etc/fstab
      line: 'tmpfs /run tmpfs {{run_opts}} 0 0'
      regexp: '.*/run.*'
    when: run_opts is defined
    register: fstab

  - name: resize /run
    command: mount -oremount /run
    when: fstab is changed

  - name: /etc/rc.local
    copy:
      src: rc.local
      dest: /etc/rc.local
      mode: 0755

  - name: enable ipv4 forwarding
    sysctl:
      name: net.ipv4.ip_forward
      value: '1'
      sysctl_set: yes

  - name: ferm.conf
    copy:
      src: ferm.conf
      dest: /etc/ferm/ferm.conf
      mode: 0644
    register: fermconf

  - name: enable ferm
    service:
      name: ferm
      state: started
      enabled: true

  - name: reload ferm
    service:
      name: ferm
      state: reloaded
    when: fermconf is changed

  - name: run netns-setup
    shell: /usr/local/bin/netns-setup

  - name: git user name
    git_config:
      name: user.name
      value: apt.postgresql.org buildd
      scope: global
    become: true
    become_user: buildd

  - name: git user email
    git_config:
      name: user.email
      value: pgsql-pkg-debian@lists.postgresql.org
      scope: global
    become: true
    become_user: buildd
