---
- name: top level play for lxd server provisioning
  hosts: lxd_host
  tags: install_lxd
  tasks:
    - name: include variables
      include_vars:
        file: site_vars.yml

    # TODO: use template for lxd-init --preseed
    - name: copy ssh pubkey from controller to lxd host
      copy:
        src: "{{ lookup('env', 'HOME') + '/.ssh/id_rsa.pub' }}"
        dest: "{{ tmp_pubkey }}"

    # TODO: might make sense to add a cache redirect for alpine packages
    - include_tasks: tasks/container_common.yml
      vars:
        container_name: "{{ item.key }}"
        container_sshd_port: "{{ item.value.sshd_port }}"
        container_ip: "{{ item.value.ip }}"
        tmp_sshd_config: "/tmp/sshd_config_{{ item.key }}"
      with_items: "{{ containers | dict2items }}"


#
# container specific playbooks
#

- import_playbook: tasks/dokuwiki.yml

#
# DNAT routing
#

# NOTE: do host routing last so we can fail on no sudo pass

- name: add DNAT rules for ssh to containers
  hosts: lxd_host
  tags: dnat_route
  tasks:
    - include_vars:
        file: site_vars.yml

    - name: install iptables and iptables-persistent
      become: yes
      apt:
        name: [iptables, iptables-persistent]
        state: present

    - name: add rules on containers
      iptables:
        table: nat
        chain: PREROUTING
        in_interface: "{{ host_iface }}"
        protocol: tcp
        match: tcp
        source: "{{ host_cidr }}"
        jump: DNAT
        destination_port: "{{ item.value.sshd_port }}"
        to_destination: "{{ item.value.ip }}"
      become: yes
      with_items: "{{ containers | dict2items }}"

    - name: save DNAT rules on lxd host
      become: yes
      community.general.iptables_state:
        table: nat
        state: saved
        path: /etc/iptables/rules.v4

- name: add DNAT rules for individual containers
  hosts: lxd_host
  tags: dnat_route_2
  tasks:
    - include_vars:
        file: site_vars.yml

    - iptables:
        table: nat
        chain: PREROUTING
        in_interface: "{{ host_iface }}"
        protocol: tcp
        match: tcp
        source: "{{ host_cidr }}"
        jump: DNAT
        destination_port: "{{ hostvars['dokuwiki']['dnat_dest_port'] }}"
        to_destination: "{{ hostvars['dokuwiki']['internal_ip'] }}"
      become: yes

    - iptables:
        table: nat
        chain: PREROUTING
        in_interface: "{{ host_iface }}"
        protocol: tcp
        match: tcp
        source: "{{ host_cidr }}"
        jump: DNAT
        destination_port: "{{ hostvars['freshrss']['dnat_dest_port'] }}"
        to_destination: "{{ hostvars['freshrss']['internal_ip'] }}"
      become: yes