name: Apply ansible playbooks

on:
  push:
    branches:
      - main
    paths:
      - "ansible/**"
      - .github/workflows/ansible-apply.yaml

jobs:
  apply-playbooks:
    runs-on: ubuntu-latest

    steps:
      - name: Checkout repository
        uses: actions/checkout@v2

      - name: Setup Sectool
        uses: a13labs/setup-sectool@v1

      - name: Install Python and required packages
        run: |
          sudo apt-get update
          sudo apt-get install -y python3-pip
          python3 -m pip install -r requirements.txt

      - name: Setup SSH Key
        env:
          VAULT_MASTER_PASSWORD: ${{ secrets.VAULT_MASTER_PASSWORD }}
        run: |
          sectool ssh unlock ansible
          mkdir -p ~/.ssh
          chmod 700 ~/.ssh
          cp ssh-keys/ansible/id_rsa ~/.ssh/id_rsa
          chmod 600 ~/.ssh/id_rsa

      - name: Configure SSH to Disable Host Key Checking
        env:
          TRUSTE_HOSTS: ${{ secrets.TRUSTED_HOSTS }}
        run: |
          mkdir -p ~/.ssh
          for host in $TRUSTED_HOSTS; do
            ssh-keyscan $host >> ~/.ssh/known_hosts
          done

      - name: Apply Ansible Playbook
        env:
          VAULT_MASTER_PASSWORD: ${{ secrets.VAULT_MASTER_PASSWORD }}
          ANSIBLE_USER: ${{ secrets.ANSIBLE_USER }}
        run: |
          cd ansible
          sectool exec ansible-playbook -i inventory/hosts playbook_microk8s.yml
          sectool exec ansible-playbook -i inventory/hosts playbook_gitea.yml
          sectool exec ansible-playbook -i inventory/hosts playbook_nextcloud.yml
          sectool exec ansible-playbook -i inventory/hosts playbook_wordpress.yml