community.egi.eu.yml

---
# Ansible playbook to deploy and maintain the EGI community forum
- hosts: forum
  name: harden ssh
  become: true
  tasks:
    - name: Configure remote access
      authorized_key:
        user: root
        exclusive: true
        key: "{{ item }}"
      loop:
        - 'https://github.com/gwarf.keys'
        - 'https://github.com/enolfc.keys'
        - 'https://github.com/brucellino.keys'
  roles:
    - {role: dev-sec.ssh-hardening, tags: ssh}

- hosts: forum
  name: Provide certs
  become: true
  tags:
    - ssl
  tasks:
    - name: Ensure SSL location is present
      file:
        path: "{{ cert_location }}"
        state: directory
        owner: root
        group: root
    - name: Copy Cert Chain
      copy:
        src: etc/ssl/community_egi_eu.crt
        dest: "{{ cert_location }}/server.crt"
        owner: root
        group: root
        mode: u=rw,g=r
    - name: Copy cert key
      copy:
        src: etc/ssl/community_egi_eu.key
        dest: "{{ cert_location }}/server.key"
        owner: root
        group: root
        mode: "u=r"
    - name: sort out firewall
      debug:
        msg: "TODO"

- hosts: forum
  name: Deploy !
  become: true
  tags:
    - discourse
  roles:
    - {role: AAROC.discourse-sso, launch: 'False'}