site.yml

- name: Common setup (all nodes)
  hosts: volpe_master, volpe_workers
  vars:
    volpe_repo: https://github.com/volpe-framework/volpe-application.git
    volpe_dir: /opt/volpe
    volpe_version: main
    go_version: "1.24.2"

  tasks:
    - name: Get user account details
      getent:
        database: passwd
        key: "{{ ansible_user }}"

    - name: Set user home and Go arch facts
      set_fact:
        user_home: "{{ getent_passwd[ansible_user][4] }}"
        go_arch: >-
          {{ 'amd64' if ansible_facts['architecture'] == 'x86_64'
             else 'arm64' if ansible_facts['architecture'] in ['aarch64', 'arm64']
             else 'amd64' }}

    - name: Set Go download URL facts
      set_fact:
        go_tarball: "go{{ go_version }}.linux-{{ go_arch }}.tar.gz"
        go_url: "https://go.dev/dl/go{{ go_version }}.linux-{{ go_arch }}.tar.gz"

    - name: Check installed Go version
      command: /usr/local/go/bin/go version
      register: installed_go
      changed_when: false
      failed_when: false

    - name: Install Go {{ go_version }}
      when: >
        installed_go.rc != 0 or
        ('go' + go_version) not in installed_go.stdout
      block:
        - name: Download Go tarball
          become: true
          get_url:
            url: "{{ go_url }}"
            dest: "/tmp/{{ go_tarball }}"
            mode: "0644"

        - name: Remove existing Go installation
          become: true
          file:
            path: /usr/local/go
            state: absent

        - name: Extract Go to /usr/local
          become: true
          unarchive:
            src: "/tmp/{{ go_tarball }}"
            dest: /usr/local
            remote_src: true

    - name: Verify Go version
      command: /usr/local/go/bin/go version
      register: go_version_output
      changed_when: false

    - name: Install system dependencies (Debian/Ubuntu)
      become: true
      apt:
        name:
          - podman
          - git
          - pkg-config
          - libgpgme-dev
          - libbtrfs-dev
          - libdevmapper-dev
          - libseccomp-dev
          - build-essential
        state: present
        update_cache: true
      when: ansible_facts['os_family'] == "Debian"

    - name: Install system dependencies (RedHat/Fedora/CentOS)
      become: true
      dnf:
        name:
          - podman
          - git
          - pkgconf-pkg-config
          - gpgme-devel
          - btrfs-progs-devel
          - device-mapper-devel
          - libseccomp-devel
          - gcc
          - make
        state: present
      when: ansible_facts['os_family'] == "RedHat"

    - name: Create VolPE directory
      become: true
      file:
        path: "{{ volpe_dir }}"
        state: directory
        owner: "{{ ansible_user }}"
        group: "{{ ansible_user }}"
        mode: "0755"

    - name: Enable systemd linger for ansible_user
      become: true
      command: "loginctl enable-linger {{ ansible_user }}"
      args:
        creates: "/var/lib/systemd/linger/{{ ansible_user }}"

    - name: Get ansible_user uid
      command: "id -u {{ ansible_user }}"
      register: user_uid
      changed_when: false

    - name: Enable and start podman socket for ansible_user
      become: true
      become_user: "{{ ansible_user }}"
      command: systemctl --user enable --now podman.socket
      environment:
        XDG_RUNTIME_DIR: "/run/user/{{ user_uid.stdout }}"
      register: podman_socket_enable
      changed_when: false
      failed_when: podman_socket_enable.rc != 0

    - name: Wait for podman socket file to exist
      wait_for:
        path: "/run/user/{{ user_uid.stdout }}/podman/podman.sock"
        timeout: 30

    - name: Clone VolPE repository
      git:
        repo: "{{ volpe_repo }}"
        dest: "{{ volpe_dir }}"
        version: "{{ volpe_version }}"
        recursive: true
        update: true
        accept_hostkey: true

    - name: Get podman socket path
      become: true
      become_user: "{{ ansible_user }}"
      command: podman info -f "{{ '{{' }}.Host.RemoteSocket.Path{{ '}}' }}"
      environment:
        XDG_RUNTIME_DIR: "/run/user/{{ user_uid.stdout }}"
      register: podman_sock_raw
      changed_when: false
      failed_when: podman_sock_raw.rc != 0

    - name: Set podman socket fact
      set_fact:
        podman_socket: "unix://{{ podman_sock_raw.stdout }}"

- name: Deploy VolPE master
  hosts: volpe_master
  vars:
    volpe_dir: /opt/volpe
    master_api_port: "8000"
    master_grpc_port: "8080"

  tasks:
    - name: Open master ports in UFW (Debian/Ubuntu)
      become: true
      ufw:
        rule: allow
        port: "{{ item }}"
        proto: tcp
      loop:
        - "{{ master_api_port }}"
        - "{{ master_grpc_port }}"
      when: ansible_facts['os_family'] == "Debian"
      ignore_errors: true

    - name: Open master ports in firewalld (RedHat/Fedora)
      become: true
      ansible.posix.firewalld:
        port: "{{ item }}/tcp"
        permanent: true
        state: enabled
        immediate: true
      loop:
        - "{{ master_api_port }}"
        - "{{ master_grpc_port }}"
      when: ansible_facts['os_family'] == "RedHat"
      ignore_errors: true

    - name: Install volpe-master systemd service
      become: true
      copy:
        dest: /etc/systemd/system/volpe-master.service
        mode: "0644"
        content: |
          [Unit]
          Description=VolPE Master
          After=network.target
          
          [Service]
          ExecStart=/usr/bin/env go run .
          WorkingDirectory={{ volpe_dir }}/master
          Restart=always
          RestartSec=10
          StartLimitIntervalSec=120
          StartLimitBurst=5
          User={{ ansible_user }}
          Environment="HOME={{ user_home }}"
          Environment="CONTAINER_HOST={{ podman_socket }}"
          Environment="PATH=/usr/local/go/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
          Environment="CGO_ENABLED=1"

          [Install]
          WantedBy=multi-user.target

    - name: Start volpe-master
      become: true
      systemd:
        name: volpe-master
        state: started
        daemon_reload: true
        enabled: true

    - name: Wait for master API port
      wait_for:
        port: "{{ master_api_port }}"
        host: localhost
        timeout: 180
        delay: 10
      register: port_wait
      ignore_errors: true

    - name: Dump master journal
      become: true
      command: journalctl -u volpe-master -n 50 --no-pager
      register: master_journal
      changed_when: false
      failed_when: false

    - name: Fail if master port never opened
      fail:
        msg: "Master API port {{ master_api_port }} did not open"
      when: port_wait is failed

    - name: Confirm master API is reachable
      uri:
        url: "http://localhost:{{ master_api_port }}/problems"
        status_code: 200
      retries: 10
      delay: 5
      register: api_check
      until: api_check.status == 200

- name: Deploy VolPE workers
  hosts: volpe_workers
  vars:
    volpe_dir: /opt/volpe
    master_grpc_port: "8080"
    master_ip: "{{ hostvars[groups['volpe_master'][0]]['ansible_host'] }}"

  tasks:
    - name: Pre-flight — verify master gRPC port is reachable
      wait_for:
        host: "{{ master_ip }}"
        port: "{{ master_grpc_port }}"
        timeout: 60

    - name: Write worker config.ini
      become: true
      copy:
        dest: "{{ volpe_dir }}/worker/config.ini"
        owner: "{{ ansible_user }}"
        group: "{{ ansible_user }}"
        mode: "0644"
        content: |
          [general]
          volpe_master={{ master_ip }}:{{ master_grpc_port }}
          worker_id={{ inventory_hostname }}

          [resources]
          memory_gb={{ worker_memory_gb | default(2.0) }}
          cpu_count={{ worker_cpu_count | default(2) }}

    - name: Install volpe-worker systemd service
      become: true
      copy:
        dest: /etc/systemd/system/volpe-worker.service
        mode: "0644"
        content: |
          [Unit]
          Description=VolPE Worker
          After=network.target
          
          [Service]
          ExecStart=/usr/bin/env go run . -config-path {{ volpe_dir }}/worker/config.ini
          WorkingDirectory={{ volpe_dir }}/worker
          Restart=always
          RestartSec=10
          StartLimitIntervalSec=120
          StartLimitBurst=5
          User={{ ansible_user }}
          Environment="HOME={{ user_home }}"
          Environment="CONTAINER_HOST={{ podman_socket }}"
          Environment="PATH=/usr/local/go/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
          Environment="CGO_ENABLED=1"

          [Install]
          WantedBy=multi-user.target

    - name: Start volpe-worker
      become: true
      systemd:
        name: volpe-worker
        state: started
        daemon_reload: true
        enabled: true

    - name: Dump worker journal
      become: true
      command: journalctl -u volpe-worker -n 50 --no-pager
      register: worker_journal
      changed_when: false
      failed_when: false

- name: Teardown master
  hosts: volpe_master
  tags: [teardown, never]
  tasks:
    - name: Stop and disable volpe-master
      become: true
      systemd:
        name: volpe-master
        state: stopped
        enabled: false

- name: Teardown workers
  hosts: volpe_workers
  tags: [teardown, never]
  tasks:
    - name: Stop and disable volpe-worker
      become: true
      systemd:
        name: volpe-worker
        state: stopped
        enabled: false