---
#============================================================================================================
# Basic Settings
#============================================================================================================
- hosts: all
  become: true
  roles:
    # ===============  Preconditions  =============== #
    # first, before enroll: fails on roles that cannot run together (e.g. docker + k3s) and fixes what
    # would make the whole run fail (e.g. broken apt sources)
    - base/preconditions

    # ===============  Base  =============== #
    - base/enroll
    - base/linux-apt
    - base/linux-basic
    - base/zfs
    - base/nullmailer

    - base/smartd
    - base/hdparm

    # ===============  Base Services  =============== #
    - base-services/wireguard
    - base-services/tailscale
    - base-services/docker
    - base-services/samba
    - base-services/rsyncd
    - base-services/mariadb

    # ===============  Backup   =============== #
    - base-services/borg
    - base-services/borgmatic
    - base-services/goback

    # ===============  Security   =============== #
    - security/lynis
    - security/malwarescan

#============================================================================================================
# Linux Server
#============================================================================================================
- hosts:
    - linux_servers
  become: true
  roles:
    # ===============  Security   =============== #
    #    - security/fail2ban
    - security/crowdsec
    - security/firewall

    # ===============  Web Base  =============== #
    - web-base/php-fpm
    - web-base/caddy
    - web-base/authelia
    - web-base/vhosts # configure caddy proxies, php, etc.

    # ===============  Monitoring  =============== #
    - monitoring/prometheus
    - monitoring/alertmanager
    - monitoring/node_exporter
    - monitoring/grafana
    - monitoring/monit

    # ===============  Servarr  =============== #
    - servarr/transmission
    - servarr/prowlarr
    - servarr/sonarr
    - servarr/radarr
    - servarr/lidarr
    - servarr/whisparr
    - servarr/romm

    # ===============  Web  =============== #
    - webservices/radicale
    - webservices/fe26
    - webservices/aether

    # docker compose based
    - webservices/mealie # https://github.com/mealie-recipes/mealie/discussions/801
    - webservices/homepage
    - webservices/dashi
    - webservices/immich
    - webservices/docmost
    - webservices/etnafinance

    # php based
    - webservices/mediawiki
    - webservices/phpmyadmin

    # servar related
    - servarr/jellyfin
    - servarr/stash
    - servarr/xbvr
    - servarr/kavita

    # ===============  Other services  =============== #
    - games/minecraft

    # ===============  K8s  =============== #
    # Last on purpose: k3s fails if a program already listens on a port ServiceLB publishes (80/443 by default),
    # and that check only sees the services of the roles above if they ran first.
    - k8s/k3s

#============================================================================================================
# Linux Desktop
#============================================================================================================

- hosts:
    - linux_desktop
  become: true
  roles:
    # basic desktop
    - desktop/vbox-guest
    - desktop/linux-desktop
    - desktop/linux-kde

    # GUI desktop apps (selection via gui_apps_config)
    - desktop/gui-apps

#============================================================================================================
# Tools — CLI utilities and developer toolchains, any host (opt-in via <role>_config)
#============================================================================================================

- hosts: all
  become: true
  roles:
    # CLI utilities (selection via cli_apps_config)
    - tools/cli-apps
    # developer toolchains (selection via the matching dev_*_config)
    - tools/dev-node
    - tools/dev-go
    - tools/dev-java
    - tools/dev-k8s
    - tools/dev-ai
    - tools/dev-generic

#============================================================================================================
# post setup actions
# some roles will depend on previous configuration, e.g. web service users existent
#============================================================================================================

- hosts: all
  become: true
  roles:
    - role: base-services/goback
      vars:
        run_goback_profiles: true
    # at the end, as last step we write the new version
    - role: base/enroll
      vars:
        run_autobott_write_version: true