---
# Everything the deploy pipeline manages on asxpio-ops. asxpio-services
# runs NixOS and is described in ../nixos. Idempotent: a run with nothing
# to change touches nothing and restarts nothing.
#
#   ansible-playbook site.yaml --check --diff        # dry run
#   ansible-playbook site.yaml --tags traefik        # one service
#
# Host bootstrap (WireGuard, SSH hardening, swap) is in playbooks/
# and is run by hand.

- name: Host baseline
  hosts: ops_servers
  become: true
  roles:
    - { role: base, tags: [base] }

- name: asxpio-ops services
  hosts: ops_servers
  become: true
  roles:
    - { role: traefik, tags: [traefik] }
    - { role: crawler_alert, tags: [crawler_alert] }

# Late: restarting Forgejo briefly cuts the runner off from its job log
- name: Forgejo
  hosts: ops_servers
  become: true
  roles:
    - { role: forgejo, tags: [forgejo] }