bastion.yml

- name: Configure bastion
  hosts: bastion
  become: true
  pre_tasks:
    - file:
        path: /root/.ssh
        state: directory
        owner: root
        mode: 0700

  roles:
    - role: common
      common_hostname: "{{ bonnyci_hostname | default('') }}"

    - role: sshd
      tags:
        - sshd

    - role: dd-agent
      tags:
        - monitoring
      when: secrets is defined

    - role: letsencrypt-apache
      tags:
        - letsencrypt
      when: letsencrypt_csr_cn | default(False)

    - bastion
    - role: datadog-builder
      datadog_builder_secrets:
        api_key: "{{ secrets.datadog.api_key }}"
        app_key: "{{ secrets.datadog.ansible_app_key }}"
      when: secrets is defined
    - role: logrotate
      logrotate_configs:
        - name: datadog-builder
          path: /var/log/datadog-builder/*log
          options:
            - compress
            - missingok
            - rotate 30
            - daily
            - notifempty
      when: secrets is defined

    - role: mysql
      mysql_root_password: "{{ secrets.db_password }}"
      tags: ['mysql']

    - role: dd-mysql
      dd_mysql_password: "{{ secrets.datadog.mysql_password }}"
      tags:
        - monitoring

    - role: ara-db
      ara_db_username: "{{ secrets.ara.username }}"
      ara_db_password: "{{ secrets.ara.password }}"

    - role: ara-web
      ara_db_username: "{{ secrets.ara.username }}"
      ara_db_password: "{{ secrets.ara.password }}"
      ara_db_host: localhost
      ara_webroot: /var/www/ara
      ara_file_owner: www-data
      ara_file_group: www-data

    - role: uwsgi
      uwsgi_apt_plugins:
        - uwsgi-plugin-python
      uwsgi_vassals:
        - name: ara
          state: present
          config:
            uid: www-data
            gid: www-data
            wsgi-file: "{{ ara_venv_path }}/bin/ara-wsgi"
            virtualenv: "{{ ara_venv_path }}"
            chdir: /var/www/ara
            plugin: python
            socket: localhost:3311
            lazy-apps: true

    - role: ansible-runner
      ansible_runner_minute: "*/15"
      ara_enabled: "{{ bonnyci_ara_enabled | default(False) | bool }}"
      ara_db_username: "{{ secrets.ara.username }}"
      ara_db_password: "{{ secrets.ara.password }}"
      ara_db_host: "localhost"
      when: secrets is defined

    - role: tailon
      tailon_ip: 127.0.0.1
      tailon_port: 8080
      tailon_relative_root: /cron-logs/live/
      tailon_files:
        - "/var/www/html/cron-logs/**/*_current.log"

    - role: apache
      apache_apt_install:
        - libapache2-mod-proxy-uwsgi
      apache_mods_enabled:
        - proxy.conf
        - proxy.load
        - proxy_http.load
        - proxy_uwsgi.load
      apache_vhosts:
        - name: bastion
          document_root: /var/www/html/
          document_root_options: +FollowSymLinks
          ssl: "{{ bonnyci_bastion_ssl | default(False) }}"
          certificate_file: "{{ letsencrypt_cert_path | default('') }}"
          certificate_key_file: "{{ letsencrypt_key_path | default('') }}"
          certificate_chain_file: "{{ letsencrypt_chain_path | default('') }}"
          vhost_extra: |
            AddType text/plain .log

            Redirect permanent /cron-logs/live /cron-logs/live/

            ProxyPass "/cron-logs/live/" http://localhost:8080/cron-logs/live/

            Redirect permanent /ara /ara/
            <Location "/ara/">
              ProxyPass uwsgi://localhost:3311/
              SetEnv ANSIBLE_CONFIG /var/www/ara/ansible.cfg
            </Location>

        - name: tailon
          delete: yes

        - name: ara
          delete: yes

    - role: dd-apache
      tags:
        - monitoring

    - role: filebeat
      filebeat_prospectors:
        - name: apache
          prospectors:
            - input_type: log
              document_type: apache
              paths:
                - /var/log/apache/*.log

    - role: fail2ban  # This should be last