---
- name: top level playbook for lxd server provisioning
  hosts: lxd_host
  tasks:
    - name: include variables
      include_vars:
        file: site_vars.yml

    # TODO: use template for lxd-init --preseed
    - name: copy ssh pubkey from controller to lxd host
      copy:
        src: "{{ lookup('env', 'HOME') + '/.ssh/id_rsa.pub' }}"
        dest: "{{ tmp_pubkey }}"
      when: not debug_skip

    - include_tasks: tasks/container_common.yml
      vars:
        container_name: "{{ item.key }}"
        container_sshd_port: "{{ item.value.sshd_port }}"
        container_ip: "{{ item.value.ip }}"
        tmp_sshd_config: "/tmp/sshd_config_{{ item.key }}"
      with_items: "{{ containers | dict2items }}"

    # NOTE: do container specific provisioning
    - import_tasks: tasks/dokuwiki.yml
      vars:
        doku_lxc_cmd: "{{ lxc_cmd }}"
      when: not debug_skip

    # NOTE: do host routing last so we can can on no sudo pass
    # TODO: add task for installing iptables & iptables-persistent on debian
    # TODO: save rules after updating
    - name: add DNAT rules for ssh to containers
      iptables:
        table: nat
        chain: PREROUTING
        in_interface: "{{ host_iface }}"
        protocol: tcp
        match: tcp
        source: "{{ host_cidr }}"
        jump: DNAT
        destination_port: "{{ item.value.sshd_port }}"
        to_destination: "{{ item.value.ip }}"
      become: yes
      when: not debug_skip
      with_items: "{{ containers | dict2items }}"