setup-idm.yml

---

- import_playbook: ensure-vm-state.yml
  vars:
    memory_mb: 4096
    num_cpus: 2
    state: poweredon
    net_name: RH-seg-2991
    net_type: static
    ip: "{{ ipaserver_master_ip }}"
    netmask: 255.255.255.0
    gateway: "{{ ipaserver_gw }}"
    name: "{{ ipaserver_master_name }}"
    domain: "{{ ipaserver_domain }}"
    dns_servers:
      - "{{ dns_forwarder1_ip }}"
      - "{{ dns_forwarder2_ip }}"
  tags: server

- import_playbook: ensure-vm-state.yml
  vars:
    memory_mb: 4096
    num_cpus: 2
    state: poweredon
    net_name: RH-seg-2991
    net_type: static
    ip: "{{ ipaserver_replica_ip }}"
    netmask: 255.255.255.0
    gateway: "{{ ipaserver_gw }}"
    name: "{{ ipaserver_replica_name }}"
    domain: "{{ ipaserver_domain }}"
    dns_servers:
      - "{{ dns_forwarder1_ip }}"
      - "{{ dns_forwarder2_ip }}"
  tags: replica

- import_playbook: prepare-rhel.yml
  vars:
    install_pkgs_list:
      - tmux
      - vim
      - insights-client
  tags: prep

- name: setup stuff at IdMs
  hosts:
    - ipaservers
    - ipareplicas
  tasks:

    - name: set yum module
      command:
        cmd: yum module enable -y idm:DL1
        warn: false
      tags: yum

    - name: sync new yum stream
      command:
        cmd: yum distro-sync -y
        warn: false
      tags: yum

    - name: check ipv6 is enabled
      replace:
        path: /etc/default/grub
        regexp: 'ipv6.disable=1'
      register: ipv6

    - name: re-generate grub
      command: grub2-mkconfig -o /boot/grub2/grub.cfg
      when: ipv6 is changed

    - name: re-generate initramd
      command: dracut -f
      when: ipv6 is changed

    - name: create hosts entry for ipv6
      lineinfile:
        path: /etc/hosts
        regexp: '^::1.*'
        line: >-
          ::1         localhost localhost.localdomain
          localhost6 localhost6.localdomain6

    - name: create hosts entry for idm master
      lineinfile:
        path: /etc/hosts
        regexp: ".*{{ ipaserver_master_name }}.*"
        line: >-
          {{ ipaserver_master_ip }}
          {{ ipaserver_master_name }}.{{ ipaserver_domain }}
          {{ ipaserver_master_name }}

    - name: create hosts entry for idm replica
      lineinfile:
        path: /etc/hosts
        regexp: ".*{{ ipaserver_replica_name }}.*"
        line: >-
          {{ ipaserver_replica_ip }}
          {{ ipaserver_replica_name }}.{{ ipaserver_domain }}
          {{ ipaserver_replica_name }}

    - name: reboot to get ipv6
      reboot:
        reboot_timeout: 120
      when: ipv6 is changed

- name: setup IdM server
  hosts:
    - ipaservers
  tasks:

    - name: ensure fqdn hostname
      hostname:
        name: "{{ ipaserver_master_name }}.{{ ipaserver_domain }}"
        use: systemd

    - name: apply freeipa role
      include_role:
        name: freeipa.ansible_freeipa.ipaserver
      vars:
        state: present

    - name: permit IdM traffic
      ansible.posix.firewalld:
        service: "{{ item }}"
        permanent: true
        state: enabled
      loop:
        - freeipa-ldap
        - freeipa-ldaps
        - dns
      tags: firewall
  tags: server


- name: setup IdM replica
  hosts: ipareplicas
  tasks:

    - name: ensure fqdn hostname
      hostname:
        name: "{{ ipaserver_replica_name }}.{{ ipaserver_domain }}"
        use: systemd

    - name: apply freeipa role
      include_role:
        name: freeipa.ansible_freeipa.ipareplica
      vars:
        state: present

    - name: permit IdM traffic
      ansible.posix.firewalld:
        service: "{{ item }}"
        permanent: true
        state: enabled
      loop:
        - freeipa-ldap
        - freeipa-ldaps
        - dns
      tags: firewall
  tags: replica

- name: setup IdM DNS configs
  hosts:
    - ipaservers
  tasks:

    - name: setup dns zone
      freeipa.ansible_freeipa.ipadnszone:
        ipaadmin_password: "{{ ipaadmin_password }}"
        name: "{{ ipaserver_domain }}"
        allow_sync_ptr: true
        dynamic_update: true
        state: present

    - name: setup reverse zone
      freeipa.ansible_freeipa.ipadnszone:
        ipaadmin_password: "{{ ipaadmin_password }}"
        name: "{{ item }}"
        allow_sync_ptr: true
        dynamic_update: true
        state: present
      loop: "{{ dns_reverse_zones }}"
  tags: dns