---

- hosts: localhost
  connection: local
  gather_facts: no
  vars_files:
    - vars/ec2_security_groups.yaml
  tasks:
    - name: camera triage security group
      ec2_group:
        name: camera triage
        description: .
        vpc_id: '{{ vpc.vpc_default }}'
        region: us-west-1
        rules:
          - proto: tcp
            from_port: '{{ ports.ssh }}'
            to_port: '{{ ports.ssh }}'
            cidr_ip: '{{ cidr.corp.all }}'
          - proto: tcp
            from_port: '{{ ports.http }}'
            to_port: '{{ ports.http }}'
            cidr_ip: '{{ cidr.corp.all }}'

    - name: provision hosts
      ec2:
        exact_count: 1
        count_tag:
          Role: camera_triage

        image: ami-4c03562c # Ubuntu 14.04 amd64 hvm:ebs-ssd
        instance_type: m4.2xlarge
        region: us-west-1

        instance_tags:
          Role: camera_triage
          Name: camera-triage.zooxlabs.com
        key_name: VPN Server
        vpc_subnet_id: subnet-d8cd79bc # Labeling us-west-1a private
        group:
          - camera triage
        assign_public_ip: no
        private_ip: 10.1.7.70

        volumes:
          - device_name: /dev/sda1
            volume_size: 1024
            delete_on_termination: yes

        wait: yes
      register: camera_triage
    # This allows us to immediately configure these servers, despite not being
    # part of the tag at the start of the run.
    - name: add newly-provisioned servers to host group
      add_host: hostname={{ item.private_ip }} groups=new_camera_triage_hosts
      with_items: '{{ camera_triage.instances }}'
    - name: wait for provisioned servers to start ssh
      wait_for:
        host: "{{ item.private_ip }}"
        port: 22
      with_items: '{{ camera_triage.instances }}'
    - name: accept new ssh fingerprints
      shell: ssh-keyscan -H {{ item.private_ip }} >> ~/.ssh/known_hosts
      with_items: '{{ camera_triage.instances }}'

- hosts: tag_Role_camera_triage:new_camera_triage_hosts
  roles:
    - role: ansible-role-dns
      become: yes
      dns_domain: 'zooxlabs.com'
      dns_searchs:
        - 'zooxlabs.com'
        - 'us-west-1.compute.internal'
      dns_nameservers:
        - '10.1.255.25'   # Zoox ec2 dns 1
        - '10.1.255.26'   # Zoox ec2 dns 2
        - '10.1.0.2'      # AWS dns
    - role: likewise
    - role: sudo
      sudoers_users:
        - name: jamesph
        - name: james
    - role: sshd
      sshd:
        # See sshd_config(5) for descriptions of these options.
        AllowUsers: ubuntu jamesph james
        PasswordAuthentication: yes
        PermitEmptyPasswords: no
        PermitRootLogin: no
        Protocol: 2
        StrictModes: yes
    - role: camera-triage
