---

- name: Assemble Duply include patterns

    dest: "/etc/duply/main/include"

    src: "/etc/duply/main/patterns"

    owner: root

  tasks:

    - name: Install python for Ansible

      changed_when: false

    - name: Update all caches to avoid errors due to missing remote archives

        update_cache: true

      changed_when: false

---

- name: Configure backup patterns

    src: "backup_patterns.j2"

    dest: "/etc/duply/main/patterns/{{ backup_patterns_filename }}"

    owner: root

    - Assemble Duply include patterns

- name: Explicitly run all handlers

  when: "run_handlers | default(False) | bool()"

  tags:

    - handlers

  #   This task is invoked only if user is very specific about requiring to

  #   run the handlers manually as a way to bring the system to consistency

  #   after interrupted runs.

- name: Create keyring directory

    path: "/etc/duply/main/gnupg"

    state: directory

    owner: root

  #   This task is invoked only if user is very specific about requiring to

  #   run the handlers manually as a way to bring the system to consistency

  #   after interrupted runs.

- name: Import public keys  # noqa no-changed-when

  # [no-changed-when] Commands should not change things if nothing needs doing

  #   This task is invoked only if user is very specific about requiring to

  #   run the handlers manually as a way to bring the system to consistency

  #   after interrupted runs.

  when: backup_additional_encryption_keys | length > 0

  tasks:

    - name: Deploy pre-backup script

        src: tests/data/10-test-pre-backup.sh

        dest: /etc/duply/main/pre.d/10-test-pre-backup.sh

        owner: root

  tasks:

    - name: Install python for Ansible

      changed_when: false

    - name: Update all caches to avoid errors due to missing remote archives

        update_cache: true

      changed_when: false

  tasks:

    - name: Deploy SSH server keys

        content: "{{ lookup('file', item.key) + '\n' }}"

        dest: "{{ item.value }}"

        owner: root

        - Restart ssh

    - name: Drop the outdated public keys

        path: "{{ item }}"

        state: absent

      with_items:

        - /etc/ssh/ssh_host_ecdsa_key.pub

    - name: Force the use of internal-sftp subsystem for SFTP

        path: /etc/ssh/sshd_config

        regexp: "^Subsystem.*sftp"

        line: "Subsystem sftp internal-sftp"

        state: present

    - name: Deploy custom SSH server configuration that chroots users

        src: "tests/data/backup_server-sshd-chroot_backup_users.conf"

        dest: "/etc/ssh/sshd_config.d/chroot_backup_users.conf"

        owner: root

        - Restart ssh

    - name: Set-up backup group that will contain all backup users

        name: "backup-users"

    - name: Set-up backup user groups

        name: "{{ item.name }}"

      with_items: "{{ backup_users }}"

    - name: Set-up backup users

        name: "{{ item.name }}"

        group: "{{ item.name }}"

        groups:

      with_items: "{{ backup_users }}"

    - name: Set-up authorised keys

        user: "{{ item.name }}"

        key: "{{ item.key }}"

      with_items: "{{ backup_users }}"

    - name: Set-up port forwarding

      changed_when: false

      with_items:

        - 2222

        - 3333

    - name: Change ownership of home directories for SFTP chroot to work

        path: "/home/{{ item.name }}"

        state: directory

        owner: root

      with_items: "{{ backup_users }}"

    - name: Set-up duplicity backup directories

        path: "~{{ item.name }}/duplicity"

        state: directory

        owner: root

  handlers:

    - name: Restart ssh

        name: ssh

        state: restarted

---

- name: Install backup software

    name:

      - duplicity

      - duply

    state: present

- name: Set-up Duply directories

    path: "{{ item }}"

    state: directory

    owner: root

    - "/var/cache/duply/main"

- name: Deploy GnuPG private keys

    content: "{{ backup_encryption_key }}"

    dest: "/etc/duply/main/private_keys.asc"

    owner: root

    - Import public keys

- name: Deploy GnuPG public keys

    content: "{{ backup_additional_encryption_keys | join('\n') }}"

    dest: "/etc/duply/main/public_keys.asc"

    owner: root

    - Import public keys

- name: Extract encryption key identifier (Duplicty requires key ID in hexadecimal format)

    head -n1 | sed -e 's/.*: //'"

  args:

    executable: /bin/bash

  failed_when: not backup_encryption_key_id.stdout

- name: Extract additional encryption keys identifiers (Duplicty requires key ID in hexadecimal format)

    sed -e 's/.*: //' | sort -u | tr '\n' ',' | sed -e 's/,$//'"

  args:

    executable: /bin/bash

  failed_when: not backup_additional_encryption_keys_ids.stdout

- name: Deploy private SSH key for logging-in into backup server

    content: "{{ backup_ssh_key }}"

    dest: "/etc/duply/main/ssh/identity"

    owner: root

  no_log: true

- name: Deploy custom known_hosts for backup purposes

    src: "known_hosts.j2"

    dest: "/etc/duply/main/ssh/known_hosts"

    owner: root

    mode: "0600"

- name: Deploy Duply configuration file

    src: "duply_main_conf.j2"

    dest: "/etc/duply/main/conf"

    owner: root

    mode: "0600"

- name: Deploy base exclude pattern (exclude all by default)

    content: "- **"

    dest: "/etc/duply/main/exclude"

    owner: root

    mode: "0600"

- name: Set-up directory for storing pre-backup scripts

    path: "/etc/duply/main/pre.d/"

    state: directory

    owner: root

    mode: "0700"

- name: Set-up script for running all pre-backup scripts

    src: "duply_pre"

    dest: "/etc/duply/main/pre"

    owner: root

    mode: "0700"

- name: Deploy crontab entry for running backups

    name: backup

    cron_file: backup

    hour: "2"

    user: root

- name: Ensure the file with include patterns exists (but do not overwrite)

    content: ""

    dest: /etc/duply/main/include

    force: false

    mode: "0600"

- name: Explicitly run all handlers

  when: "run_handlers | default(False) | bool()"

  tags:

    - handlers

---

- name: Restart backup SSH server

    name: ssh-backup

    state: restarted

  tasks:

    - name: Fix SSH client file permissions locally, otherwise we get error from SSH

        path: "{{ item }}"

        mode: g=,o=

      with_items:

  tasks:

    - name: Install python for Ansible

      changed_when: false

    - name: Update all caches to avoid errors due to missing remote archives

        update_cache: true

---

- name: Install backup software

    name:

      - duplicity

      - duply

    state: present

- name: Create directory for storing backups

    path: "/srv/backups"

    state: directory

    owner: root

    mode: "0751"

- name: Create backup client groups

    name: "{{ item.server | replace('.', '_') | regex_replace('^', 'bak-') }}"

    gid: "{{ item.uid | default(omit) }}"

    system: true

  with_items: "{{ backup_clients }}"

- name: Create backup client users

    name: "{{ item.server | replace('.', '_') | regex_replace('^', 'bak-') }}"

    group: "{{ item.server | replace('.', '_') | regex_replace('^', 'bak-') }}"

    groups: "backup"

  with_items: "{{ backup_clients }}"

- name: Create home directories for backup client users

    path: "/srv/backups/{{ item.server }}"

    state: directory

    owner: root

  with_items: "{{ backup_clients }}"

- name: Create duplicity directories for backup client users

    path: "/srv/backups/{{ item.server }}/duplicity"

    state: directory

    owner: "{{ item.server | replace('.', '_') | regex_replace('^', 'bak-') }}"

  with_items: "{{ backup_clients }}"

- name: Create SSH directory for backup client users

    path: "/srv/backups/{{ item.server }}/.ssh"

    state: directory

    owner: root

  with_items: "{{ backup_clients }}"

- name: Populate authorized keys for backup client users

    user: "{{ item.server | replace('.', '_') | regex_replace('^', 'bak-') }}"

    key: "{{ item.public_key }}"

    manage_dir: false

  with_items: "{{ backup_clients }}"

- name: Set-up authorized_keys file permissions for backup client users

    path: "/srv/backups/{{ item.server }}/.ssh/authorized_keys"

    state: file

    owner: root

  with_items: "{{ backup_clients }}"

- name: Deny the backup group login via regular SSH

    dest: "/etc/ssh/sshd_config"

    state: present

    line: "DenyGroups backup"

    - Restart SSH

- name: Set-up directory for the backup OpenSSH server instance

    path: "/etc/ssh-backup/"

    state: directory

    owner: root

    mode: "0700"

- name: Deploy configuration file for the backup OpenSSH server instance service

    src: "ssh-backup.default"

    dest: "/etc/default/ssh-backup"

    owner: root

    - Restart backup SSH server

- name: Deploy configuration file for the backup OpenSSH server instance

    src: "backup-sshd_config"

    dest: "/etc/ssh-backup/sshd_config"

    owner: root

    - Restart backup SSH server

- name: Deploy the private keys for backup OpenSSH server instance

    src: "ssh_host_key.j2"

    dest: "/etc/ssh-backup/ssh_host_{{ item.key }}_key"

    owner: root

  no_log: true

- name: Deploy backup OpenSSH server systemd service file

    src: "ssh-backup.service"

    dest: "/etc/systemd/system/ssh-backup.service"

    owner: root

    - Restart backup SSH server

- name: Start and enable OpenSSH backup service

    name: "ssh-backup"

    state: started

    enabled: true

- name: Deploy firewall configuration for backup server

    src: "ferm_backup.conf.j2"

    dest: "/etc/ferm/conf.d/40-backup.conf"

    owner: root

    - Restart ferm

- name: Explicitly run all handlers

  when: "run_handlers | default(False) | bool()"

  tags:

    - handlers

---

- name: Dummy handler to suppress Ansible warnings

    msg: "This is just a dummy task to suppress the Ansible warning about an empty include."

  tasks:

    - name: Install python for Ansible

      changed_when: false

    - name: Update all caches to avoid errors due to missing remote archives

        update_cache: true

      changed_when: false

  tasks:

    - name: Deploy authorized_keys to mimic set-up via preseed file

        user: root

        key: "{{ lookup('file', '~/.ssh/id_rsa.pub') }}"

  tasks:

    - name: Deploy authorized_keys to mimic set-up via preseed file

        user: root

        key: "{{ lookup('file', 'tests/data/ansible_key.pub') }}"

---

- name: Install sudo

    name: sudo

    state: present

- name: Set-up the Ansible group

    name: ansible

    system: true

- name: Set-up the Ansible user

    name: ansible

    system: true

    group: ansible

    shell: /bin/bash

- name: Set-up authorized key for the Ansible user

    user: ansible

    key: "{{ ansible_key }}"

- name: Set-up password-less sudo for the ansible user

    src: "ansible_sudo"

    dest: "/etc/sudoers.d/ansible"

    mode: "0640"

    group: root

- name: Revoke rights for Ansible user to log-in as root to server via ssh

    user: root

    key: "{{ ansible_key }}"

    state: absent

- name: Explicitly run all handlers

  when: "run_handlers | default(False) | bool()"

  tags:

    - handlers

  #   This task is invoked only if user is very specific about requiring to

  #   run the handlers manually as a way to bring the system to consistency

  #   after interrupted runs.

- name: Restart SSH

    name: ssh

    state: restarted

  #   This task is invoked only if user is very specific about requiring to

  #   run the handlers manually as a way to bring the system to consistency

  #   after interrupted runs.

- name: Restart ferm

    name: ferm

    state: restarted

- name: Reload systemd

    daemon_reload: true

- name: Restart NTP server

    name: ntpsec

    state: restarted

  when: ntp_pools | length > 0

  tasks:

    - name: Remove X.509 material

        path: "{{ item }}"

        state: absent

      with_items:

  tasks:

    - name: Set-up directories for testing pip requirements upgrade checks script

        path: "{{ item }}"

        state: directory

        owner: root

        - "/tmp/pip_check_requirements_upgrades/without_updates"

    - name: Deploy files for testing pip requirements upgrade checks script

        src: "{{ item }}"

        dest: "/tmp/{{ item }}"

        owner: root

        - "pip_check_requirements_upgrades/without_updates/requirements.txt"

    - name: Install web server for testing connectivity

        name: nginx

        state: present

    - name: Deploy firewall configuration file for the web server

        src: ferm_http.conf

        dest: /etc/ferm/conf.d/99-http.conf

        owner: root

  handlers:

    - name: Restart ferm

        name: ferm

        state: restarted

  tasks:

    - name: Initialise CA hierarchy

      args:

        creates: ".gimmecert/ca/level1.cert.pem"

        chdir: "tests/data/"

    - name: Set-up link to generated X.509 material

        src: ".gimmecert"

        dest: "tests/data/x509"

        state: link

  tasks:

    - name: Install python for Ansible

      changed_when: false

    - name: Update all caches to avoid errors due to missing remote archives

        update_cache: true

      changed_when: false

    - name: Install net-tools for running Testinfra host.socket tests

        name: net-tools

        state: present

    - name: Remove the ss utility (see https://github.com/philpep/testinfra/pull/320)

        path: "/bin/ss"

        state: absent

  tasks:

    - name: Install apt-cacher-ng

        name: apt-cacher-ng

        state: present

  tasks:

    - name: Install tool for testing TCP connectivity

        name: nmap

        state: present

    - name: Set-up /etc/hosts with entries for all servers

        path: /etc/hosts

        regexp: "^{{ item.key }}"

        line: "{{ item.key }} {{ item.value }}"

  tasks:

    - name: Set-up /etc/hosts with entries for all servers

        path: /etc/hosts

        regexp: "^{{ item.key }}"

        line: "{{ item.key }} {{ item.value }}"

        192.168.56.4: client2

    - name: Load legacy iptables to test their removal

        name: "{{ item }}"

        state: present

      with_items:

    - name: Create some custom legacy iptables chains for testing their removal (max chain name length is 29)  # noqa no-changed-when

      # [no-changed-when] Commands should not change things if nothing needs doing

      #   Does not matter in test prepare stage.

      with_items:

        - filter

        - nat

    - name: Create some custom legacy ip6tables chains for testing their removal (max chain name length is 29)  # noqa no-changed-when

      # [no-changed-when] Commands should not change things if nothing needs doing

      #   Does not matter in test prepare stage.

      with_items:

        - filter

        - nat

        - raw

    - name: Create deprecated directory for storing requirements files created using Python 3 (pip requirements upgrade checks)