---
- name: main lxd_host block
  vars:
    img_server: https://images.linuxcontainers.org
    alp_img_alias: alpine/3.13/amd64
    lxc_cmd: /snap/bin/lxc
    lxd_subnet_pfx: 10.98.46
    lxd_bridge: lxdbr0
    tmp_pubkey: /tmp/controller_key_rsa.pub
  block:
  # TODO: use template for lxd-init --preseed
  - name: copy ssh pubkey from controller to lxd host
    copy:
      src: "{{ lookup('env', 'HOME') + '/.ssh/id_rsa.pub' }}"
      dest: "{{ tmp_pubkey }}"

  # TODO: might make sense to add a cache redirect for alpine packages
  - include_tasks: tasks/container_install.yml
    tags: container_install
    vars:
      container_name: "{{ item }}"
      container_sshd_port: "{{ hostvars[item]['ansible_port'] }}"
      container_ip: "{{ hostvars[item]['internal_ip'] }}"
      tmp_sshd_config: "/tmp/sshd_config_{{ item }}"
    with_items: "{{ groups['containers'] }}"

  - name: install iptables and iptables-persistent
    tags: routing
    become: yes
    apt:
      name: [iptables, iptables-persistent]
      state: present
    when: "'routing' in ansible_run_tags"

  - name: add DNAT rules for containers
    tags: routing
    iptables:
      table: nat
      chain: PREROUTING
      in_interface: "{{ host_iface }}"
      protocol: tcp
      match: tcp
      source: "{{ (host_ipt_ssh_cidr is defined) | ternary(host_ipt_ssh_cidr, '0.0.0.0')  }}"
      jump: DNAT
      destination_port: "{{ hostvars[item]['ansible_port'] }}"
      to_destination: "{{ hostvars[item]['internal_ip'] }}"
    become: yes
    with_items: "{{ groups['containers'] }}"
    when: "'routing' in ansible_run_tags"

  - name: save DNAT rules on lxd host
    tags: routing
    become: yes
    community.general.iptables_state:
      table: nat
      state: saved
      path: /etc/iptables/rules.v4
    when: "'routing' in ansible_run_tags"

  # TODO: add other dnat ports in above loop?
  #- name: add dokuwiki DNAT routing
  #  iptables:
  #    table: nat
  #    chain: PREROUTING
  #    in_interface: "{{ host_iface }}"
  #    protocol: tcp
  #    match: tcp
  #    source: "{{ host_cidr }}"
  #    jump: DNAT
  #    destination_port: "{{ hostvars['dokuwiki']['dnat_dest_port'] }}"
  #    to_destination: "{{ hostvars['dokuwiki']['internal_ip'] }}"
  #  become: yes
  #
  #- name: add freshrss DNAT routing
  #  iptables:
  #    table: nat
  #    chain: PREROUTING
  #    in_interface: "{{ host_iface }}"
  #    protocol: tcp
  #    match: tcp
  #    source: "{{ host_cidr }}"
  #    jump: DNAT
  #    destination_port: "{{ hostvars['freshrss']['dnat_dest_port'] }}"
  #    to_destination: "{{ hostvars['freshrss']['internal_ip'] }}"
  #  become: yes