prod.yml

---
- name: sysadm
  tags: sysadm
  become: yes
  hosts: all
  roles:
    - { role: sysadm }

- name: mariadb
  tags: mariadb
  become: yes
  hosts: db
  roles:
    - { role: mariadb }

- name: puma
  tags: puma
  become: yes
  hosts: www_worker
  roles:
    - { role: puma }

- name: certbot
  tags: nginx
  become: yes
  hosts: www
  roles:
    - certbot
  vars:
    certbot_testmode: false
    certbot_create_if_missing: true
    certbot_admin_email: peter@push.cx
    certbot_create_method: standalone
    certbot_hsts: true
    # the ubuntu certbot package added a systemd timer service
    certbot_auto_renew: false
    #certbot_auto_renew_user: root
    #certbot_auto_renew_hour: "5"
    #certbot_auto_renew_minute: "23"
    certbot_create_standalone_stop_services:
      - nginx
    certbot_certs:
      - email: peter@push.cx
        webroot: "/srv/lobste.rs/http/public"
        domains:
          - lobste.rs
          - www.lobste.rs
          - lobsters.dev
          - www.lobsters.dev

- name: nginx
  tags: nginx
  become: yes
  hosts: www
  roles:
    - { role: nginx }

- name: postfix
  tags: postfix
  become: yes
  hosts: mx:smtp
  roles:
    - { role: postfix }

- name: lobsters
  tags: lobsters
  become: yes
  hosts: www_worker
  roles:
    - { role: lobsters }