- name: Update system things
  hosts: mountain-of-faith
  become: true
  tasks:

    - name: Remove big packages
      ansible.builtin.apt:
        name: "{{ item }}"
        state: absent
        update_cache: true
        autoremove: true
      loop:
        - chromium

    - name: Install things
      ansible.builtin.apt:
        name: "{{ item }}"
        state: present
        update_cache: true
      loop:
        - neovim

    - name: Update all packages to their latest version
      ansible.builtin.apt:
        name: "*"
        state: latest
        update_cache: true
        autoremove: true

    - name: Upgrade the OS (apt-get dist-upgrade)
      ansible.builtin.apt:
        upgrade: dist

# What a pain in the ass - useful things for debugging:
#
# - https://tailscale.com/blog/sisyphean-dns-client-linux
# - https://wiki.archlinux.org/title/Systemd-resolved
# - resolvectl status
# - resolvectl query DOMAIN_NAME
- name: Configure systemd-resolved
  tags: resolved
  hosts: mountain-of-faith
  become: true
  tasks:

    - name: Configure systemd-resolved
      ansible.builtin.copy:
        dest: /etc/systemd/resolved.conf
        content: |
          [Resolve]
          # tailscale
          DNS=100.100.100.100
          Domains={{ tailscale.tailnet_name }}.ts.net

          # pihole
          DNSStubListener=no
        mode: "0644"
      notify: restart systemd-resolved

    - name: Enable and start systemd-resolved
      ansible.builtin.systemd:
        name: systemd-resolved
        enabled: true
        state: started

  handlers:
    - name: restart systemd-resolved
      ansible.builtin.systemd:
        name: systemd-resolved
        state: restarted

- import_playbook: ../playbooks/tailscale.yml
- import_playbook: ../playbooks/docker.yml

- name: Mount USB drive
  hosts: mountain-of-faith
  become: true
  tasks:

    # Use `lsblk -f` to find the UUID
    - name: Mount the USB drive to /mnt/mountain-of-faith
      ansible.posix.mount:
        path: /mnt/mountain-of-faith
        src: UUID=337a82a2-0046-4cbf-93f3-8fc978c3e944
        fstype: ext4
        opts: defaults,nofail
        state: mounted

- name: Set up Restic
  tags: restic
  hosts: mountain-of-faith
  become: true
  tasks:

    - name: Create Restic user
      ansible.builtin.user:
        name: restic
        system: true
        # '*' rather than Debian's default locked '!': sshd under UsePAM no
        # refuses locked users, and this play should match lolk's.
        password: "*"
        state: present

    - name: Add SSH key for restic user
      ansible.posix.authorized_key:
        user: restic
        key: "{{ item }}"
      loop:
        - ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILrlVay1GlpCuhYSUup/K/gRYmltycViPBAdZ8t9OKtu # lotus-land-story
        - ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPgX0tA28NO3djYaV++JxggR0t47xou+R0HQVwVjzj8s # 1password

    - name: Create Restic directory
      ansible.builtin.file:
        path: /mnt/mountain-of-faith/restic
        state: directory
        owner: restic
        group: restic
        mode: "0755"

- name: Create Docker network
  hosts: mountain-of-faith
  become: true
  tasks:
    - name: Create IPv6 Docker network
      community.docker.docker_network:
        name: mountain-of-faith
        enable_ipv6: true
        state: present

- name: Run Pi-Hole
  tags: pihole
  hosts: mountain-of-faith
  vars:
    version: 2025.11.1
  tasks:

    - name: Run the Pi-Hole container
      become: true
      community.docker.docker_container:
        name: pihole
        image: pihole/pihole:{{ version }}
        ports:
          - "53:53/tcp"
          - "53:53/udp"
          - "80:80/tcp"
          # - "443:443/tcp"
          # - "67:67/udp" # DHCP
          # - "123:123/udp" # NTP
        networks:
          - name: mountain-of-faith
        env:
          TZ: "America/Los_Angeles"
          FTLCONF_webserver_api_password: "{{ pihole.password }}"
          FTLCONF_dns_listeningMode: "all"
          FTLCONF_dns_upstreams: "1.1.1.1;1.0.0.1;2606:4700:4700::1111;2606:4700:4700::1001" # cloudflare
        volumes:
          - "./etc-pihole:/etc/pihole"
        capabilities:
          - NET_ADMIN
          - SYS_TIME
          - SYS_NICE
        restart_policy: unless-stopped
        state: started
      no_log: true

# TODO Remove Minio
- import_playbook: minio.yml

- import_playbook: ../playbooks/syncthing.yml

- name: Set up metrics
  tags: metrics
  hosts: mountain-of-faith
  become: true
  tasks:

    - name: Install blackbox-exporter
      ansible.builtin.apt:
        name: "{{ item }}"
        state: present
      loop:
        - prometheus-blackbox-exporter
        - prometheus-node-exporter

    - name: Create Blackbox config directory
      ansible.builtin.file:
        path: /mnt/mountain-of-faith/blackbox-exporter
        state: directory
        mode: "0755"

    - name: Create Blackbox configuration file
      ansible.builtin.copy:
        dest: /mnt/mountain-of-faith/blackbox-exporter/blackbox.yml
        content: |
          modules:
            dns:
              prober: dns
              dns:
                preferred_ip_protocol: ip4
                query_name: kejadlen.dev
                query_type: A # https://blog.cloudflare.com/rfc8482-saying-goodbye-to-any/
            dns_ipv6:
              prober: dns
              dns:
                query_name: kejadlen.dev
                query_type: A # https://blog.cloudflare.com/rfc8482-saying-goodbye-to-any/
            http:
              prober: http
              http:
                preferred_ip_protocol: ip4
            http_internal:
              prober: http
              http:
                preferred_ip_protocol: ip4
                tls_config:
                  # TODO use ca_file instead
                  insecure_skip_verify: true
            http_ipv6:
              prober: http
            icmp:
              prober: icmp
              timeout: 5s
              icmp:
                preferred_ip_protocol: "ip4"
        mode: "0644"
      notify: restart blackbox-exporter

    - name: Configure blackbox-exporter service
      ansible.builtin.lineinfile:
        path: /etc/default/prometheus-blackbox-exporter
        regexp: '^ARGS='
        line: 'ARGS="--config.file=/mnt/mountain-of-faith/blackbox-exporter/blackbox.yml"'
      notify: restart blackbox-exporter

    # Not sure if this actually works, but can alternatively use
    # `dpkg-reconfigure prometheus-blackbox-exporter`
    - name: Enable ICMP capabilities for blackbox-exporter
      ansible.builtin.command: setcap cap_net_raw+ep /usr/bin/prometheus-blackbox-exporter
      changed_when: false
      notify: restart blackbox-exporter

  handlers:
    - name: restart blackbox-exporter
      ansible.builtin.systemd:
        name: prometheus-blackbox-exporter
        state: restarted

- name: Run Prusa Exporter
  tags: prusa-exporter
  hosts: mountain-of-faith
  become: true
  vars:
    version: 2.0.0-rc1
  tasks:

    - name: Create Prusa Exporter config directory
      ansible.builtin.file:
        path: /mnt/mountain-of-faith/prusa-exporter
        state: directory
        mode: "0755"

    - name: Create Prusa Exporter configuration file
      ansible.builtin.template:
        src: templates/prusa.yml
        dest: /mnt/mountain-of-faith/prusa-exporter/prusa.yml
        mode: "0644"
      vars:
        # can we get this dynamically?
        address: 192.168.40.60
      notify: restart prusa-exporter

    - name: Run the Prusa Exporter container
      community.docker.docker_container:
        name: prusa-exporter
        image: pubeldev/prusa_exporter:{{ version }}
        ports:
          - "10009:10009/tcp"
          - "8514:8514/udp"
        volumes:
          - "/mnt/mountain-of-faith/prusa-exporter/prusa.yml:/app/prusa.yml:ro"
        command:
          - "--config.file=/app/prusa.yml"
          - "--log.level=info"
          - "--prusalink.scrape-timeout=5"
          - "--udp.ip-override={{ host_ip }}"
          - "--udp.gcode-enabled"
          # TODO?
          # - "--loki.push-url=http://localhost:9428/insert/loki/api/v1/push"
        restart_policy: unless-stopped
        state: started
      vars:
        host_ip: "{{ ansible_facts.default_ipv4.address }}"

  handlers:
    - name: restart prusa-exporter
      community.docker.docker_container:
        name: prusa-exporter
        state: started
        restart: true

- import_playbook: ups.yml

# vim: ft=yaml.ansible