From 0ae1913d9c2807680bbd23ce2e0df903d08af1b0 Mon Sep 17 00:00:00 2001
From: Florian Fischer <florian.fischer@muhq.space>
Date: Fri, 15 Mar 2024 13:48:19 +0100
Subject: initial commit

---
 tasks/main.yml | 80 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 80 insertions(+)
 create mode 100644 tasks/main.yml

(limited to 'tasks')

diff --git a/tasks/main.yml b/tasks/main.yml
new file mode 100644
index 0000000..a0e5f75
--- /dev/null
+++ b/tasks/main.yml
@@ -0,0 +1,80 @@
+- name: "Setup password-less SSH port forwarding from {{ relay_host }} to {{ inventory_hostname }}"
+  tags:
+    - ssh
+  ansible.builtin.include_role:
+    name: ssh_relay_access
+    apply:
+      delegate_to: "{{ relay_host }}"
+      tags:
+        - relayed_domain
+  # prefix the variables with their role name to prevent scoping issues
+  vars:
+    ssh_relay_accessing_host: "{{ relay_host }}"
+    ssh_relay_accessed_host: "{{ inventory_hostname }}"
+    ssh_relay_accessed_user: "{{ ansible_user }}"
+
+- name: "Configure the SSH access from {{ relay_host }} to {{ inventory_hostname }}"
+  tags:
+    - ssh
+  block:
+    - name: "Authorize the {{ relay_host }} host key at {{ inventory_hostname }}"
+      ansible.builtin.include_role:
+        name: ssh_authorize_host
+        apply:
+          delegate_to: "{{ relay_host }}"
+          tags:
+            - relayed_domain
+      vars:
+        ssh_relayed_hostname: "{{ inventory_hostname }}"
+        ssh_hostname: "{{ relay_host }}"
+        ssh_port: "{{ relayed_host_ssh_port }}"
+
+    - name: "Add {{ inventory_hostname }} to {{ relay_host }}'s ssh config"
+      delegate_to: "{{ relay_host }}"
+      ansible.builtin.blockinfile:
+        create: true
+        mode: '600'
+        path: ~/.ssh/config
+        marker: "# {mark} ANSIBLE MANAGED BLOCK {{ inventory_hostname }}"
+        block: |
+          Host {{ inventory_hostname }}
+            User {{ ansible_user }}
+            Port {{ relayed_host_ssh_port }}
+            IdentityFile ~/.ssh/{{ relay_ssh_key_name }}
+
+- name: "Add relayed domain ({{ domain }}) to {{ relay_host }}"
+  ansible.builtin.include_role:
+    name: uberspace_domains
+    apply:
+      delegate_to: "{{ relay_host }}"
+      tags:
+        - relayed_domain
+    tasks_from: web
+  vars:
+    domains:
+      - "{{ domain }}"
+
+- name: Add web backend for the relayed domain to the relay port
+  tags:
+    - ssh
+  delegate_to: "{{ relay_host }}"
+  # TODO: detect if this is necessary
+  ansible.builtin.command:
+    cmd: "uberspace web backend set {{ domain }} --http --port {{ relay_port }}"
+
+- name: Setup port forward service useing supervisorctl
+  tags:
+    - ssh
+  delegate_to: "{{ relay_host }}"
+  block:
+    - name: Install service file
+      ansible.builtin.template:
+        src: forward-service.ini.j2
+        dest: "~/etc/services.d/forward-{{ relay_port }}-to-{{ inventory_hostname }}-{{ relayed_port }}.ini"
+        mode: '644'
+      register: forward_service
+
+    - name: Ensure port forward service is running
+      community.general.supervisorctl:
+        name: "forward-{{ relay_port }}-to-{{ inventory_hostname }}-{{ relayed_port }}"
+        state: "{{ 'restarted' if forward_service.changed else 'started' }}"
-- 
cgit v1.2.3