---
- name: Ensure base config is deployment on base_config_hosts
  hosts: base_config_hosts
  roles:
    - base_config
  tags:
    - base_config

- name: Ensure secrets deployment on secrets_hosts
  hosts: secrets_hosts
  roles:
    - secrets
  tags:
    - secrets

- name: Ensure systemd-networkd config deployment on systemd_networkd_hosts
  hosts: systemd_networkd_hosts
  roles:
    - systemd_networkd
  tags:
    - systemd_networkd

- name: Ensure nftables deployment on nftables_hosts
  hosts: nftables_hosts
  roles:
    - nftables
  tags:
    - nftables

- name: Ensure deployment of infrastructure authorized keys
  hosts: infrastructure_authorized_keys_hosts
  roles:
    - infrastructure_authorized_keys
  tags:
    - infrastructure_authorized_keys

- name: Ensure Nextcloud config
  hosts: nextcloud_hosts
  roles:
    - nextcloud
  tags:
    - nextcloud

- name: Ensure ola deployment on ola_hosts
  hosts: ola_hosts
  roles:
    - ola
  tags:
    - ola

- name: Ensure foobazdmx deployment on foobazdmx_hosts
  hosts: foobazdmx_hosts
  roles:
    - foobazdmx
  tags:
    - foobazdmx

- name: Ensure Dokuwiki config
  hosts: wiki_hosts
  roles:
    - dokuwiki
  tags:
    - dokuwiki

- name: Ensure NetBox deployment on netbox_hosts
  hosts: netbox_hosts
  roles:
    - netbox
  tags:
    - netbox

- name: Ensure NGINX deployment on nginx_hosts, which are also public_reverse_proxy_hosts, before certbot role runs
  hosts: nginx_hosts:&public_reverse_proxy_hosts
  roles:
    - nginx
  tags:
    - nginx
    - public_reverse_proxy

- name: Ensure certbot and certificate deployment on certbot_hosts
  hosts: certbot_hosts
  roles:
    - certbot
  tags:
    - certbot

- name: Ensure OnlyOffice custom fonts
  ansible.builtin.import_playbook: onlyoffice_fonts.yaml
  tags:
    - onlyoffice_fonts

- name: Ensure Docker Compose deployment on docker_compose_hosts
  hosts: docker_compose_hosts
  roles:
    - docker_compose
  tags:
    - docker_compose

- name: Ensure NGINX deployment on nginx_hosts
  hosts: nginx_hosts:!public_reverse_proxy_hosts
  roles:
    - nginx
  tags:
    - nginx

- name: Configure unattended upgrades for all non-hypervisors
  hosts: all:!hypervisors
  become: true
  roles:
    - role: debops.debops.unattended_upgrades
      vars:
        unattended_upgrades__origins:
          - "o=${distro_id},n=${distro_codename}"
          - "o=Docker,n=${distro_codename}"
          - "o=nginx,n=${distro_codename}"
  tags:
    - unattended_upgrades

- name: Ensure Alloy is installed and Setup on alloy_hosts
  hosts: alloy_hosts
  become: true
  roles:
    - alloy
  tags:
    - alloy

- name: Ensure ansible_pull deployment on ansible_pull_hosts
  hosts: ansible_pull_hosts
  roles:
    - ansible_pull
  tags:
    - ansible_pull

- name: Ensure msmtp is setup on msmtp_hosts
  hosts: msmtp_hosts
  roles:
    - msmtp
  tags:
    - msmtp

- name: Ensure Renovate is setup on renovate_hosts
  hosts: renovate_hosts
  roles:
    - renovate
  tags:
    - renovate

- name: Run ensure_eh22_styleguide_dir Playbook
  ansible.builtin.import_playbook: ensure_eh22_styleguide_dir.yaml
  tags:
    - eh22_styleguide_dir

- name: Setup authoritative dns servers
  hosts: auth-dns
  roles:
    - knot
  tags:
    - knot