---
# Playbook: prepare-new-server.yml
#
# Kompletni priprava noveho Ubuntu serveru:
# 1. Update systemu (apt)
# 2. Deploy user (UID 1000, heslo zamknuto)
# 3. SSH klice (pro deploy uzivatele)
# 4. Adresarova struktura (/home/deploy/docker, ...)
# 5. Docker Engine + Compose plugin
# 6. Deploy user v docker group (docker bez sudo)
# 7. UFW firewall (povoleno SSH, HTTP, HTTPS)
# 8. fail2ban
#
# Pouziti:
#   # 1. Nastavit inventory.yml a pridat svuj verejny klic do group_vars/all.yml
#   # 2. ansible-playbook -i inventory.yml playbooks/prepare-new-server.yml
#
# Co playbook predpoklada:
# - Server ma Ubuntu 22.04 nebo 24.04 LTS
# - Pristup pres SSH s heslem (root nebo sudo user) pro ansible_become
# - V inventory.yml je nastaven ansible_host, ansible_user (s sudo prava)
#
- name: Priprav novy Ubuntu server
  hosts: homeservers
  become: true
  gather_facts: true

  vars:
    # Default pro prepare-new-server.yml - lze prepsat v inventory
    ssh_port: 22
    fail2ban_maxretry: 5
    fail2ban_bantime: 3600  # 1 hodina

  pre_tasks:
    - name: Varovani pred spustenim
      ansible.builtin.pause:
        prompt: |

          ============================================
          PRIPRAVA NOVEHO SERVERU

          Tento playbook:
          - updatuje system
          - vytvori deploy usera (UID 1000)
          - nahraje SSH klice
          - nainstaluje Docker + Compose
          - vytvori adresarovou strukturu
          - nastavi firewall

          SSH pristup bude fungovat pro deploy usera s tvym verejnym klicem.
          Pokud se neco pokazi, pripoj se pres puvodniho usera (z inventory).

          Pokracovat? (Enter = ano, Ctrl+C = prerusit)
          ============================================
      when: confirm_run | default(true) | bool

  roles:
    - role: common
      tags: [common, base]
    - role: deploy-user
      tags: [user, deploy]
    - role: ssh-keys
      tags: [ssh, keys]
    - role: firewall
      tags: [firewall, ufw]
    - role: docker
      tags: [docker]
    - role: directories
      tags: [directories, docker]

  post_tasks:
    - name: Nainstaluj fail2ban
      ansible.builtin.apt:
        name:
          - fail2ban
        state: present
        update_cache: true

    - name: Nastav fail2ban jail pro SSH
      ansible.builtin.copy:
        dest: /etc/fail2ban/jail.local
        content: |
          [DEFAULT]
          bantime  = {{ fail2ban_bantime }}
          findtime = 10m
          maxretry = {{ fail2ban_maxretry }}

          [sshd]
          enabled = true
          port    = {{ ssh_port }}
          filter  = sshd
          logpath = /var/log/auth.log
          maxretry = {{ fail2ban_maxretry }}
        mode: "0644"
      notify: Restart fail2ban

    - name: Aktivuj fail2ban
      ansible.builtin.systemd:
        name: fail2ban
        state: started
        enabled: true

    - name: Vypis stav serveru
      ansible.builtin.debug:
        msg: |
          ============================================
          SERVER PRIPRAVEN

          SSH pristup: deploy@{{ ansible_host | default(inventory_hostname) }}:{{ ssh_port }}
          Docker: docker --version (bez sudo)
          Sluzby: /home/{{ deploy_user }}/docker/<sluzba>/

          Dalsi kroky:
          1. SSH jako deploy: ssh deploy@<server-ip>
          2. Klonuj docker services: git clone http://<server-ip>:3000/mates/mates-docker-services.git
          3. Nasaď Portainer: cd docker/portainer && docker compose up -d

          ============================================

  handlers:
    - name: Restart fail2ban
      ansible.builtin.systemd:
        name: fail2ban
        state: restarted