---
- hosts:
    - master
    - worker
  become: true
  gather_facts: true
  any_errors_fatal: true
  pre_tasks:
    - name: Pausing for 5 seconds...
      ansible.builtin.pause:
        seconds: 5
  tasks:
    - name: Locale
      block:
        - name: Locale | Set timezone
          community.general.timezone:
            name: "{{ timezone | default('Etc/UTC') }}"
    - name: Networking
      block:
        - name: Networking | Set hostname to inventory hostname
          ansible.builtin.hostname:
            name: "{{ inventory_hostname }}"
        - name: Networking | Update /etc/hosts to include inventory hostname
          ansible.builtin.blockinfile:
            path: /etc/hosts
            block: |
              127.0.1.1   {{ inventory_hostname }}
    - name: Packages
      block:
        - name: Packages | Improve dnf performance
          ansible.builtin.blockinfile:
            path: /etc/dnf/dnf.conf
            block: |
              defaultyes=True
              deltarpm=True
              install_weak_deps=False
              max_parallel_downloads={{ ansible_processor_vcpus | default('8') }}
        - name: Packages | Import rpmfusion keys
          ansible.builtin.rpm_key:
            state: present
            key: "{{ item }}"
          loop:
            - https://rpmfusion.org/keys?action=AttachFile&do=get&target=RPM-GPG-KEY-rpmfusion-free-fedora-2020
            - https://rpmfusion.org/keys?action=AttachFile&do=get&target=RPM-GPG-KEY-rpmfusion-nonfree-fedora-2020
        - name: Packages | Install required packages
          ansible.builtin.dnf:
            name: "{{ packages | default([]) }}"
            state: present
            update_cache: true
        - name: Packages | Remove leaf packages
          ansible.builtin.dnf:
            autoremove: true
        - name: Packages | Enable automatic downloads of updates
          ansible.builtin.systemd:
            service: dnf-automatic-download.timer
            enabled: true
            state: started
    - name: User Configuration
      block:
        - name: User Configuration | Add additional SSH public keys
          ansible.posix.authorized_key:
            user: "{{ ansible_user }}"
            key: "{{ item }}"
          loop: "{{ public_ssh_keys | default([]) }}"
    - name: System Configuration (1)
      block:
        - name: System Configuration (1) | Disable firewalld
          ansible.builtin.systemd:
            service: firewalld.service
            enabled: false
            masked: true
            state: stopped
        - name: System Configuration (1) | Enable fstrim
          ansible.builtin.systemd:
            service: fstrim.timer
            enabled: true
    - name: System Configuration (2)
      block:
        - name: System Configuration (2) | Enable kernel modules now
          community.general.modprobe:
            name: "{{ item }}"
            state: present
          loop: [br_netfilter, overlay, rbd]
        - name: System Configuration (2) | Enable kernel modules on boot
          ansible.builtin.copy:
            mode: 0644
            content: "{{ item }}"
            dest: "/etc/modules-load.d/{{ item }}.conf"
          loop: [br_netfilter, overlay, rbd]
        - name: System Configuration (2) | Set sysctls
          ansible.posix.sysctl:
            name: "{{ item.key }}"
            value: "{{ item.value }}"
            sysctl_file: /etc/sysctl.d/99-kubernetes.conf
            reload: true
          with_dict: "{{ sysctl_config }}"
          vars:
            sysctl_config:
              net.ipv4.ip_forward: 1
              net.ipv4.conf.all.forwarding: 1
              net.ipv4.conf.all.rp_filter: 0
              net.ipv4.conf.default.rp_filter: 0
              net.ipv6.conf.all.forwarding: 1
              net.bridge.bridge-nf-call-iptables: 1
              net.bridge.bridge-nf-call-ip6tables: 1
              fs.inotify.max_user_watches: 524288
              fs.inotify.max_user_instances: 512
        - name: System Configuration (2) | Disable swap
          ansible.builtin.dnf:
            name: zram-generator-defaults
            state: absent
        - name: System Configuration (2) | Permissive SELinux
          ansible.posix.selinux:
            state: permissive
            policy: targeted
      notify: Reboot

  handlers:
    - name: Reboot
      ansible.builtin.reboot:
        msg: Rebooting nodes