ansible/roles/gitea/tasks/main.yml

---

- name: Create group
  group: name={{ gitea_group }}

- name: Create user
  user: name={{ gitea_user }} home=/home/{{ gitea_user }} group={{ gitea_group }}

- name: Create gitea directories
  file: path={{ item }} state=directory owner={{ gitea_user }}
  with_items:
  - /opt/gitea
  - /opt/gitea/custom
  - /opt/gitea/custom/conf

- name: Download gitea binary
  get_url: url={{ gitea_url }} dest=/opt/gitea/gitea checksum={{ gitea_checksum }} mode=0755
  notify: Restart gitea

- name: Configure gitea
  template: src=app.ini.j2 dest=/opt/gitea/custom/conf/app.ini force=no owner={{ gitea_user }}

- name: Install systemd unit
  template: src=gitea.service.j2 dest=/lib/systemd/system/gitea.service
  notify:
  - Reload systemd
  - Restart gitea

- name: Install PostgreSQL
  apt:
    name:
    - postgresql
    - python3-psycopg2

- name: Configure PostgreSQL database
  postgresql_db: name={{ gitea_dbname }}
  become: true
  become_user: postgres

- name: Configure PostgreSQL user
  postgresql_user: db={{ gitea_dbname }} name={{ gitea_dbuser }} password={{ gitea_dbpass }} priv=ALL state=present
  become: true
  become_user: postgres

- name: Ensure certificates are available
  command: openssl req -x509 -nodes -newkey rsa:2048 -keyout /etc/nginx/ssl/{{ gitea_domain }}.key -out /etc/nginx/ssl/{{ gitea_domain }}.crt -days 730 -subj "/CN={{ gitea_domain }}" creates=/etc/nginx/ssl/{{ gitea_domain }}.crt
  notify: Restart nginx

- name: Configure certificate manager for gitea
  template: src=certs.j2 dest=/etc/acertmgr/{{ gitea_domain }}.conf
  notify: Run acertmgr

- name: Configure robots.txt for gitea
  template: src=robots.txt.j2 dest=/opt/gitea/custom/robots.txt owner={{ gitea_user }}

- name: Configure vhost
  template: src=vhost.j2 dest=/etc/nginx/sites-available/gitea
  notify: Restart nginx

- name: Enable vhost
  file: src=/etc/nginx/sites-available/gitea dest=/etc/nginx/sites-enabled/gitea state=link
  notify: Restart nginx

- name: Enable gitea
  service: name=gitea enabled=yes

- name: Enable monitoring
  include_role: name=icinga-monitor tasks_from=http
  vars:
    vhost: "{{ gitea_domain }}"