path: root/playbook.yaml

# SPDX-FileCopyrightText: 2024 Matthew Fennell <matthew@fennell.dev>
#
# SPDX-License-Identifier: AGPL-3.0-only

---

- name: Ensure XMPP server is set up
  hosts: xmpp_server
  tasks:

   # We allow status code 400 here as this is returned by deSEC if the domain
   # already exists. Ideally, we should filter out genuinely good/bad requests
   # here using the response.
   - name: Ensure domain exists in deSEC
     ansible.builtin.uri:
      url: https://desec.io/api/v1/domains/
      method: POST
      status_code: [201, 400]
      body_format: json
      headers:
       Authorization: Token {{ desec_token }}
      body:
       name: "{{ virtual_host }}"
     register: request
     delegate_to: localhost

   - name: Ensure domain is registered
     ansible.builtin.uri:
      url: https://desec.io/api/v1/domains/{{ virtual_host }}/
      method: GET
      headers:
       Authorization: Token {{ desec_token }}
     register: domain
     delegate_to: localhost

   - name: Ensure domain to register DS record is registered
     ansible.builtin.uri:
      url: https://desec.io/api/v1/domains/?owns_qname={{ parent_host }}
      method: GET
      headers:
       Authorization: Token {{ desec_token }}
     register: parent_domain
     delegate_to: localhost

   - name: Ensure DS is registered in parent domain
     ansible.builtin.uri:
      url: "https://desec.io/api/v1/domains/{{ domain_with_ds }}/rrsets/"
      method: PUT
      body_format: json
      headers:
       Authorization: Token {{ desec_token }}
      body:
       - subname: "{{ ds_subname }}"
         type: DS
         ttl: 3600
         records: "{{ domain_keys }}"
     delegate_to: localhost

   - name: Ensure records are registered in subdomain
     ansible.builtin.uri:
      url: "https://desec.io/api/v1/domains/{{ virtual_host }}/rrsets/"
      method: PUT
      body_format: json
      headers:
       Authorization: Token {{ desec_token }}
      body:
       - subname: ""
         type: AAAA
         ttl: 3600
         records: ["{{ public_ip }}"]
       - subname: "turn"
         type: CNAME
         ttl: 3600
         records: ["{{ virtual_host }}."]
       - subname: "upload"
         type: CNAME
         ttl: 3600
         records: ["{{ virtual_host }}."]
       - subname: "_xmpps-client._tcp"
         type: SRV
         ttl: 3600
         records: ["0 5 5223 {{ virtual_host }}."]
       - subname: "_xmpps-server._tcp"
         type: SRV
         ttl: 3600
         records: ["0 5 5270 {{ virtual_host }}."]
     delegate_to: localhost

   # We specifically use apt instead of the more general package module here,
   # because we want to ensure the cache is updated before we try and install
   # anything. This is needed because, on a freh Debian install on AWS
   # Lightsail (as of 2024-02-08), nothing was returned after running apt
   # search borgmatic. Updating the cache before running apt install solved
   # this issue, but the package module does not support this functionality.
   - name: Ensure required packages are installed
     ansible.builtin.apt:
      name:
       - borgmatic  # Backups
       - coturn  # Audio / video calling server
       - lua-dbi-postgresql  # Prosody postgres connection
       - postgresql  # Database
       - prosody  # XMPP server
       - prosody-modules  # Extra addons
       - python3-psycopg2  # Used by ansible postgres role
       - ufw  # Firewall
      state: present
      update_cache: true
     become: true

   - name: Ensure required ports with ufw applications are open
     community.general.ufw:
      rule: allow
      name: "{{ item }}"
      state: enabled
     loop:
      - OpenSSH
      - Turnserver
      - WWW
      - XMPP
     become: true

   - name: Ensure other required tcp ports are open
     community.general.ufw:
      rule: allow
      port: "{{ item }}"
      proto: tcp
      state: enabled
     loop:
      - 5000  # XEP-0065
      - 5223  # XEP-0368
      - 5270  # XEP-0368
      - 5280  # XEP-0363
      - 5281  # XEP-0363
      # - 5432  # Postgres
     become: true

   - name: Ensure other udp ports are open
     community.general.ufw:
      rule: allow
      port: "{{ item }}"
      proto: udp
      state: enabled
     loop:
      - 5000  # XEP-0065
      - 5280  # XEP-0363
      - 5281  # XEP-0363
     become: true

   - name: Ensure turn is configured
     ansible.builtin.template:
      src: "{{ playbook_dir }}/files/turnserver.conf.j2"
      dest: /etc/turnserver.conf
      owner: root
      group: prosody
      mode: "0640"
     become: true
     notify: Reload coturn

   - name: Ensure prosody database is set up
     community.postgresql.postgresql_db:
      name: prosody
     become: true
     become_user: postgres

   - name: Ensure prosody role is created
     community.postgresql.postgresql_user:
      db: prosody
      name: prosody
     become: true
     become_user: postgres

   - name: Ensure prosody schema is created
     community.postgresql.postgresql_schema:
      db: prosody
      name: prosody
      owner: prosody
     become: true
     become_user: postgres
     register: my_result

   - name: Ensure prosody user exists on database
     community.postgresql.postgresql_user:
      name: prosody
     become: true
     become_user: postgres

   - name: Ensure prosody user has permissions on database
     community.postgresql.postgresql_privs:
      type: database
      database: prosody
      privs: ALL
      roles: prosody
     become: true
     become_user: postgres

   - name: Ensure prosody user has permissions on schema
     community.postgresql.postgresql_privs:
      type: table
      database: prosody
      objs: ALL_IN_SCHEMA
      privs: ALL
      roles: prosody
     become: true
     become_user: postgres

   - name: Ensure top-level prosody configuration is installed
     ansible.builtin.template:
      src: "{{ playbook_dir }}/files/prosody.cfg.lua.j2"
      dest: /etc/prosody/prosody.cfg.lua
      owner: root
      group: prosody
      mode: "0640"
     become: true
     notify: Reload prosody

   - name: Ensure host-specific prosody configuration is available
     ansible.builtin.template:
      src: "{{ playbook_dir }}/files/virtual_host.cfg.lua.j2"
      dest: "/etc/prosody/conf.avail/{{ virtual_host }}.cfg.lua"
      owner: root
      group: prosody
      mode: "0644"
     become: true
     notify: Reload prosody

   - name: Ensure host-specific prosody configuration is set
     ansible.builtin.file:
      src: "/etc/prosody/conf.avail/{{ virtual_host }}.cfg.lua"
      dest: "/etc/prosody/conf.d/{{ virtual_host }}.cfg.lua"
      owner: root
      group: prosody
      state: link
     become: true
     notify: Reload prosody

   - name: Ensure prosody is enabled
     ansible.builtin.service:
      name: prosody
      enabled: true
     become: true

   - name: Ensure borgmatic private key is installed
     ansible.builtin.copy:
      src: "{{ borg_private_key_path }}"
      dest: /root/.ssh/borg_key
      owner: root
      group: root
      mode: "0600"
     become: true

   - name: Ensure borgmatic config directory exists
     ansible.builtin.file:
      path: /etc/borgmatic
      state: directory
      owner: root
      group: root
      mode: "0700"
     become: true

   - name: Ensure borgmatic is configured
     ansible.builtin.template:
      src: "{{ playbook_dir }}/files/borgmatic_config.yaml.j2"
      dest: "/etc/borgmatic/config.yaml"
      owner: root
      group: root
      mode: "0600"
      validate: validate-borgmatic-config --config %s
     become: true

  handlers:

   - name: Reload prosody
     ansible.builtin.service:
      name: prosody
      state: reloaded
     become: true

   - name: Reload coturn
     ansible.builtin.service:
      name: coturn
      state: restarted
     become: true

  vars:
   domain_keys: >-
    {{- domain.json["keys"]
    | map(attribute='ds')
    | flatten
    | select("search", " 13 2 ") -}}
   parent_host: "{{ virtual_host.split('.')[1:] | join('.') }}"
   domain_with_ds: "{{ parent_domain.json | map(attribute='name') | first }}"
   ds_subname: "{{ virtual_host | regex_replace('.' + domain_with_ds, '') }}"