---

- set_fact:
    admin: "admin-{{ fqdn | replace('.', '_') }}"
    user: "web-{{ fqdn | replace('.', '_') }}"
    home: "/var/www/{{ fqdn }}"

- name: Create WSGI website group
  group: name="{{ user }}" gid="{{ uid | default(omit) }}" state=present

- name: Create WSGI website admin user
  user: name="{{ admin }}" uid="{{ admin_uid | default(omit) }}" group="{{ user }}"
        shell=/bin/bash createhome=no home="{{ home }}" state=present

- name: Create home directory for the user (avoid populating with skeleton)
  file: path="{{ home }}" state=directory
        owner="{{ admin }}" group="{{ user }}" mode=2750

- name: Create WSGI website user
  user: name="{{ user }}" uid="{{ uid | default(omit) }}" group="{{ user }}"
        system=yes createhome=no state=present

- name: Add nginx user to website group
  user: name="www-data" groups="{{ user }}" append="yes"
  notify:
    - Restart nginx

- name: Add admin to website group
  user: name="{{ admin }}" groups="{{ user }}" append="yes"

- name: Install extra packages for website
  apt: name="{{ item }}" state=present
  with_items: "{{ packages }}"

- name: Create directory for storing the Python virtual environment
  file: path="{{ home }}/virtualenv" state=directory
        owner="{{ admin }}" group="{{ user }}" mode="2750"

- name: Create Python virtual environment
  become_user: "{{ admin }}"
  command: /usr/bin/virtualenv --prompt "({{ fqdn }})" "{{ home }}/virtualenv" creates="{{ home }}/virtualenv/bin/activate"

- name: Configure project directory for the Python virtual environment
  template: src="venv_project.j2" dest="{{ home }}/virtualenv/.project"
            owner="{{ admin }}" group="{{ user }}" mode="640"

- name: Deploy virtualenv wrapper
  template: src="venv_exec.j2" dest="{{ home }}/virtualenv/bin/exec"
            owner="{{ admin }}" group="{{ user }}" mode="750"

- name: Deploy minimalistic bashrc for auto-activating the virtual environment
  copy: src="bashrc" dest="{{ item }}"
        owner="root" group="{{ user }}" mode="640"
  with_items:
    - "{{ home }}/.bashrc"
    - "{{ home }}/.profile"

- name: Install futures package for use with Gunicorn thread workers
  become_user: "{{ admin }}"
  pip: name=futures version="{{ futures_version }}" state=present virtualenv="{{ home }}/virtualenv"

- name: Install Gunicorn in Python virtual environment
  become_user: "{{ admin }}"
  pip: name=gunicorn version="{{ gunicorn_version }}" state=present virtualenv="{{ home }}/virtualenv"

- name: Install additional packages in Python virtual environment
  become_user: "{{ admin }}"
  pip: name="{{ item }}" state=present virtualenv="{{ home }}/virtualenv"
  with_items: "{{ virtualenv_packages }}"

- name: Deploy systemd socket configuration for website
  template: src="systemd_wsgi_website.socket.j2" dest="/etc/systemd/system/{{ fqdn }}.socket"
            owner=root group=root mode=644
  notify:
    - Reload systemd
    - "Restart website {{ fqdn }}"

- name: Deploy systemd service configuration for website
  template: src="systemd_wsgi_website.service.j2" dest="/etc/systemd/system/{{ fqdn }}.service"
            owner=root group=root mode=644
  notify:
    - Reload systemd
    - "Restart website {{ fqdn }}"

- name: Enable the website service
  service: name="{{ fqdn }}" enabled=yes state=started

- name: Create directory where static files can be served from
  file: path="{{ home }}/htdocs/" state=directory
        owner="{{ admin }}" group="{{ user }}" mode="2750"

- name: Deploy nginx TLS private key for website
  copy: dest="/etc/ssl/private/{{ fqdn }}_https.key" content="{{ https_tls_key }}"
        mode=640 owner=root group=root
  notify:
    - Restart nginx

- name: Deploy nginx TLS certificate for website
  copy: dest="/etc/ssl/certs/{{ fqdn }}_https.pem" content="{{ https_tls_certificate }}"
        mode=644 owner=root group=root
  notify:
    - Restart nginx

- name: Deploy nginx configuration file for website
  template: src="nginx_site.j2" dest="/etc/nginx/sites-available/{{ fqdn }}"
            owner=root group=root mode=640 validate="/usr/local/bin/nginx_verify_site.sh -n '{{ fqdn }}' %s"
  notify:
    - Restart nginx

- name: Enable nginx website
  file: src="/etc/nginx/sites-available/{{ fqdn }}" dest="/etc/nginx/sites-enabled/{{ fqdn }}"
        state=link
  notify:
    - Restart nginx

- name: Explicitly run all handlers
  include: ../handlers/main.yml
  when: "handlers | default(False) | bool() == True"
  tags:
    - handlers