# -*- mode: ruby -*-
# vi: set ft=ruby :

# Require YAML module
require 'yaml'
 
# Read YAML file with box and network details
inventory = YAML.load_file('inventory/hosts')
user = ENV['USER']
users_vars = inventory['all']['vars']['users_vars']
if users_vars[user]
  puts "#{user} user present in inventory, apply user settings"
  dict_name = user
else
  puts "#{user} user absent in inventory, fallback to gitlab-runner settings"
  dict_name = 'gitlab-runner'
end
user_vars = inventory['all']['vars']['users_vars'][dict_name]

Vagrant.configure("2") do |config|
  # Number of seconds to wait for establishing an SSH connection to the guest
  config.ssh.connect_timeout = 90

  # loop on **all** host(s) in pfservers group in inventory to create VM(s)
  inventory['all']['children']['pfservers']['children'].each do |groups, hosts|
    hosts['hosts'].each do |server, details|
      # don't start automatically virtual machines
      config.vm.define server, autostart: false do |srv|
        srv.vm.box = details['box']
        srv.vm.box_version = details['box_version']
        srv.vm.hostname = server
        
        # mgmt
        # libvirt__forward_mode: "route" mean:
        # Allow inbound, but only to our expected subnet. Allow outbound, but
        # only from our expected subnet. Allow traffic between guests. Deny
        # all other inbound. Deny all other outbound.
        srv.vm.network "private_network",
                       :libvirt__network_name => user_vars['networks'][0]['name'],
                       :ip => user_vars['vms'][server]['ip'],
                       :netmask => user_vars['vms'][server]['netmask'],
                       :libvirt__dhcp_enabled => false,
                       :libvirt__forward_mode => user_vars['networks'][0]['forward_mode']

        # registration
        srv.vm.network "private_network",
                       :libvirt__network_name => user_vars['networks'][1]['name'],
                       :ip => user_vars['networks'][1]['subnet'],
                       :libvirt__dhcp_enabled => false,
                       :libvirt__forward_mode => user_vars['networks'][1]['forward_mode'],
                       auto_config: false

        # isolation
        srv.vm.network "private_network",
                       :libvirt__network_name => user_vars['networks'][2]['name'],
                       :ip => user_vars['networks'][2]['subnet'],
                       :libvirt__dhcp_enabled => false,
                       :libvirt__forward_mode => user_vars['networks'][2]['forward_mode'],
                       auto_config: false

        # inline
        srv.vm.network "private_network",
                       :libvirt__network_name => user_vars['networks'][3]['name'],
                       :ip => user_vars['networks'][3]['subnet'],
                       :libvirt__dhcp_enabled => false,
                       :libvirt__forward_mode => user_vars['networks'][3]['forward_mode'],
                       auto_config: false

        srv.vm.provider "libvirt" do |v|
          v.cpus = details['cpus']
          v.memory = details['memory']
          v.machine_virtual_size = details['disk_size']
        end

        ###########################
        # extend disk partition
        ###########################
        srv.vm.provision "shell", inline: <<-SHELL
            if [ -f /etc/redhat-release ] ; then
              lvextend -l +100%FREE /dev/rhel_rhel8/root
              xfs_growfs /dev/rhel_rhel8/root
            else
              apt update
              apt install -y cloud-guest-utils
              growpart /dev/vda 1
              resize2fs -p /dev/vda1
            fi
          SHELL

        # provisionners
        # Sync timezone with host
        srv.vm.provision "shell", inline: "sudo rm /etc/localtime && sudo ln -s /usr/share/zoneinfo/#{inventory['all']['vars']['tz']} /etc/localtime", run: "always"

        # Inject the insecure Vagrant SSH key into the PacketFence server so it can be
        # used to run Venom tasks over SSH
        srv.vm.provision "insecure-ssh-key", type:"file", source: "#{Dir.home}/.vagrant.d/insecure_private_key", \
                                       destination: "/home/vagrant/.ssh/id_rsa"

        # - allow root to use insecure_private_key to connect as vagrant user on other VMs
        # - allow to SSH as root with insecure_private_key
        srv.vm.provision "shell", type: "shell" do |s|
          s.inline = <<-SHELL
                chown vagrant:vagrant /home/vagrant/.ssh/id_rsa
                chmod 600 /home/vagrant/.ssh/id_rsa
                mkdir -p /root/.ssh
                cp /home/vagrant/.ssh/id_rsa /root/.ssh/
                cp /home/vagrant/.ssh/authorized_keys /root/.ssh/
                chown -R root:root /root/.ssh/
                chmod 600 /root/.ssh/id_rsa
            SHELL
        end


        # Use to run only tasks tagged "install" in site.yml
        srv.vm.provision "config", type:"ansible", run:"never" do |config|
          config.playbook = "site.yml"
          config.config_file = "ansible.cfg"
          config.inventory_path = "inventory"
          config.tags = "install"
          # only for debug
          config.verbose = ENV['VAGRANT_ANSIBLE_VERBOSE'] || false
        end

        # Use to run only tasks tagged "upgrade" in site.yml
        srv.vm.provision "upgrade", type:"ansible", run:"never" do |config|
          config.playbook = "site.yml"
          config.config_file = "ansible.cfg"
          config.inventory_path = "inventory"
          config.tags = "upgrade"
          # only for debug
          config.verbose = ENV['VAGRANT_ANSIBLE_VERBOSE'] || false
        end
      end
    end
  end
end
