---
- hosts: internal-apps
  become: true
  vars_files: 
    - ./vars.yml
  tasks:
    - name: Update Packages
      ansible.builtin.dnf:
        update_cache: yes

    - name: Install Packages
      ansible.builtin.dnf:
        name:
          - vim
          - podman
          - fail2ban
          - python3-libdnf5
        state: present
    
    - name: Create directories 
      file:
        path: "{{ item }}"
        state: directory
        mode: '0755'
      loop: "{{ directories }}"

    - name: Create Jellyfin directories 
      file:
        path: "{{ item }}"
        state: directory
        mode: '0777'
      loop: "{{ directories_jellyfin }}"

    - name: Create internal podman network
      containers.podman.podman_network:
        name: npm_internal
        ip_range: 10.10.0.128/25
        subnet: 10.10.0.0/24
        gateway: 10.10.0.1
        state: present

    - name: Ensure WireGuard kernel module is loaded
      ansible.builtin.modprobe:
        name: wireguard
        state: present

    - name: Persist WireGuard kernel module across reboots
      ansible.builtin.copy:
        dest: /etc/modules-load.d/wg-easy.conf
        content: |
          wireguard
        mode: '0644'

    - name: Enable IP forwarding on host
      ansible.posix.sysctl:
        name: net.ipv4.ip_forward
        value: '1'
        sysctl_set: true
        state: present
        reload: true

    - name: Enable source valid mark on host
      ansible.posix.sysctl:
        name: net.ipv4.conf.all.src_valid_mark
        value: '1'
        sysctl_set: true
        state: present
        reload: true

    - name: pull images
      containers.podman.podman_image:
        name: "{{ item }}"
      loop: "{{ images }}"

    - name: Deploy Nginx Proxy Manager 
      containers.podman.podman_container:
        image: "docker.io/jc21/nginx-proxy-manager:latest"
        name: npm
        restart_policy: always
        recreate: true
        state: started
        ports:
          - "80:80"
          - "81:81"
          - "443:443"
        volumes:
          - "/opt/apps/npm:/data:z"
          - "/opt/apps/letsencrypt:/etc/letsencrypt:z"
        network:
          - npm_internal
        ip: '10.10.0.19'


    - name: Deploy Gitea 
      containers.podman.podman_container:
        image: docker.gitea.com/gitea:nightly
        name: gitea
        env:
          USER_UID: 1000
          USER_GID: 1000
        restart_policy: always
        recreate: true
        state: started
        volumes:
          - /opt/apps/gitea:/data:z
          - /usr/share/zoneinfo/America/Denver:/etc/timezone:ro
          - /etc/localtime:/etc/localtime:ro
        network:
          - npm_internal
        ip: '10.10.0.25'
        ports:
        #  - "3000:3000"
          - "222:22"

    - name: Deploy Jellyfin
      containers.podman.podman_container:
        image: lscr.io/linuxserver/jellyfin:latest
        name: jellyfin
        env:
          USER_UID: 1000
          USER_GID: 1000
          JELLYFIN_PublishedServerUrl: http://jellyfin.boxswapper.io
        restart_policy: always
        recreate: true
        state: started
        volumes:
          - /opt/apps/jellyfin/config:/config:z
          - /opt/apps/jellyfin/tvseries:/data/tvshows:z
          - /opt/apps/jellyfin/movies:/data/movies:z
          - /usr/share/zoneinfo/America/Denver:/etc/timezone:ro
          - /etc/localtime:/etc/localtime:ro
        network:
          - npm_internal
        ip: '10.10.0.30'
        # ports:
        #   - 8096:8096
      #   - 8920:8920 #optional
      #   - 7359:7359/udp #optional
      #   - 1900:1900/udp #optional

    # WireGuard Easy VPN — deployed on npm_internal behind NPM
    # After first deploy, you MUST add NAT hooks in the wg-easy UI:
    #   1. Open http://10.10.0.36:51821 in a browser
    #   2. Log in with the username/password from vars.yml
    #   3. Go to the "Hooks" tab
    #   4. PostUp — paste this EXACTLY:
    #      nft add table inet wg_table; nft add chain inet wg_table prerouting { type nat hook prerouting priority 100 \; }; nft add chain inet wg_table postrouting { type nat hook postrouting priority 100 \; }; nft add rule inet wg_table postrouting ip saddr {{ipv4Cidr}} oifname {{device}} masquerade; nft add rule inet wg_table postrouting ip6 saddr {{ipv6Cidr}} oifname {{device}} masquerade; nft add chain inet wg_table input { type filter hook input priority 0 \; policy accept \; }; nft add rule inet wg_table input udp dport {{port}} accept; nft add rule inet wg_table input tcp dport {{uiPort}} accept; nft add chain inet wg_table forward { type filter hook forward priority 0 \; policy accept \; }; nft add rule inet wg_table forward iifname "wg0" accept; nft add rule inet wg_table forward oifname "wg0" accept;
    #   5. PostDown — paste this EXACTLY:
    #      nft delete table inet wg_table
    #   6. Click Save and restart the container
    # These hooks enable VPN clients to reach your app containers (10.10.0.0/24)
    - name: Deploy WireGuard Easy (wg-easy)
      containers.podman.podman_container:
        name: wg-easy
        image: "{{ wireguard_image }}"
        restart_policy: always
        recreate: true
        state: started
        env:
          INIT_ENABLED: "true"
          INIT_USERNAME: "{{ wireguard_ui_username }}"
          INIT_PASSWORD: "{{ wireguard_ui_password }}"
          INIT_HOST: "{{ wireguard_host }}"
          INIT_PORT: "{{ wireguard_port }}"
          INIT_DNS: "{{ wireguard_default_dns }}"
          INIT_IPV4_CIDR: "{{ wireguard_cidr }}"
          INIT_IPV6_CIDR: "{{ wireguard_ipv6_cidr }}"
          INIT_ALLOWED_IPS: "{{ wireguard_allowed_ips }}"
          PORT: "{{ wireguard_ui_port }}"
          INSECURE: "true"
          DISABLE_VERSION_CHECK: "true"
        ports:
          - "{{ wireguard_port }}:{{ wireguard_port }}/udp"
          - "{{ wireguard_ui_port }}:{{ wireguard_ui_port }}/tcp"
        volumes:
          - "/opt/apps/wireguard:/etc/wireguard:z"
          - "/lib/modules:/lib/modules:ro"
        cap_add:
          - NET_ADMIN
          - SYS_MODULE
          - NET_RAW
        sysctl:
          net.ipv4.ip_forward: "1"
          net.ipv4.conf.all.src_valid_mark: "1"
        network:
          - npm_internal
        ip: '{{ wireguard_ip }}'







        


























#----N8N deployment, no GPU avail for deployment ------#

    # - name: Deploy n8n
      # containers.podman.podman_container:
      #   image: docker.n8n.io/n8nio/n8n
      #   name: n8n
      #   env:
      #     N8N_ENFORCE_SETTINGS_FILE_PERMISSIONS: true
      #     N8N_RUNNERS_ENABLED: true
      #   restart_policy: always
      #   recreate: true
      #   state: started
      #   volumes:
      #     - /opt/apps/n8n/data:/home/node/.n8n:z
      #     - /opt/apps/n8n/files:/files:z
      #     - /usr/share/zoneinfo/America/Denver:/etc/timezone:ro
      #     - /etc/localtime:/etc/localtime:ro

      #   network:
      #     - npm_internal
      #   ip: '10.10.0.35'
      # # ports:
      # #   - 5678:5678