- name: Gather facts (implicit) and packages facts
  hosts: all
  tasks:
    - name: Gather packages facts
      ansible.builtin.package_facts:
  tags:
    - "always"

- name: Create local CA
  hosts: all
  gather_facts: false
  vars_files:
    - "vars.yml"
  vars:
    local_ca_common_name: "Lab CA"
    local_ca_passphrase: "{{ vault.ca.passphrase }}"
    local_ca_country_name: "FR"
    local_ca_locality_name: "Vannes"
    local_ca_organization_name: "iTik"
    local_ca_email_address: "ca@itik.fr"
  roles:
    - "local_ca"
  tags:
    - "local_ca"

- name: Proxy server
  hosts: proxy
  gather_facts: false
  vars:
    squid_authorized_networks:
      - "{{ ansible_default_ipv4.network }}/24"
  roles:
    - "squid"
  tags:
    - "proxy"

- name: Common
  hosts: all
  gather_facts: false
  vars_files:
    - "vars.yml"
  vars:
    common_proxy_server: "{{ hostvars['proxy1'].ansible_default_ipv4.address }}:3128"
  roles:
    - "common"
  tags:
    - "common"

- name: HTTP Servers
  hosts: www
  gather_facts: false
  roles:
    - "www"
  tags:
    - "www"

- name: Web Application Firewalls
  hosts: waf
  gather_facts: false
  vars_files:
    - "vars.yml"
  vars:
    cert_domains:
      - "DNS:test.lab"
      - "DNS:{{ ansible_fqdn }}"
      - "DNS:{{ ansible_hostname }}"
      - "IP:{{ ansible_default_ipv4.address }}"
      - "DNS:server.{{ consul_datacenter }}.{{ consul_domain }}"
    cert_country_name: "FR"
    cert_locality_name: "Vannes"
    cert_organization_name: "iTik"
    cert_email_address: "ca@itik.fr"
    consul_domain: "itik.fr"
    consul_datacenter: "lab"
    consul_secret_key: "{{ vault.consul.secret_key }}"
    consul_nodes:
      - "waf1"
      - "waf2"
      - "waf3"
    bgwaf_cluster: false
    bgwaf_sites: "{{ waf.sites }}"
  roles:
    - "cert"
    - "consul"
    - "bgwaf"
  tags:
    - "bgwaf"