---
- name: Create VDC in AWS with fortigate as front
  hosts: localhost
  connection: local
  gather_facts: no
  vars:
    region: eu-west-3
    licensefile: license.lic
    wholenet: 10.100.0.0/16
    frontnet: 10.100.254.0/28
    netmaskback: 17
    backnet: "10.100.0.0/{{ netmaskback }}"
    lnet: 10.0.2.0/24
    rnet: "{{ backnet }}"
    s3name: stackdata
    keyname: mgtkey
    fgtpw: F1r3W4llP455W0rd


  tasks:
    - name: Create S3 Bucket for data
      aws_s3:
        bucket: "{{ s3name }}"
        region: "{{ region }}"
        mode: create
        permission: public-read
      register: s3bucket

    - name: Upload License
      aws_s3:
        bucket: "{{ s3name }}"
        region: "{{ region }}"
        overwrite: different
        object: "/{{ licensefile }}"
        src: "{{ licensefile }}"
        mode: put

    - name: Generate Config
      template:
        src: awsforti-template.conf.j2
        dest: fg.txt
        
    - name: Upload Config
      aws_s3:
        bucket: "{{ s3name }}"
        region: "{{ region }}"
        overwrite: different
        object: "/fg.txt"
        src: "fg.txt"
        mode: put

    - name: Create Stack
      cloudformation:
        stack_name: VPCFG
        state: present
        region: "{{ region }}"
        template: fortistack.yml
        template_parameters:
          InstanceType: c5.large
          FGUserName: admin
          KeyName: "{{ keyname }}"
          VPCName: VDCVPC
          VPCNet: "{{ wholenet }}"
          Kubnet: "{{ lnet }}"
          VPCSubnetFront: "{{ frontnet }}"
          VPCSubnetBack: "{{ backnet }}"
          S3Bucketname: "{{ s3name }}"
          LicenseFileName: "{{ licensefile }}"
          S3Region: "{{ region }}"
      register: stackinfo

    - name: Print Results
      debug: msg="{{ stackinfo.stack_outputs }}"

    - name: Wait for VM to be up
      wait_for:
        host: "{{stackinfo.stack_outputs.FortiGatepubIp }}"
        port: 22
        state: started

    - name: New Group
      add_host:
        groupname: fg
        hostname: "{{ stackinfo.stack_outputs.FortiGatepubIp }}"

    - name: Add ElaGroup1
      add_host:
        groupname: elahosts
        hostname: "{{ stackinfo.stack_outputs.Server1Address }}"

    - name: Add ElaGroup2
      add_host:
        groupname: elahosts
        hostname: "{{ stackinfo.stack_outputs.Server2Address }}"

    - name: Add NewGroup1
      add_host:
        groupname: newhosts
        hostname: "{{ stackinfo.stack_outputs.Server1Address }}"

    - name: Add NewGroup2
      add_host:
        groupname: newhosts
        hostname: "{{ stackinfo.stack_outputs.Server2Address }}"
        
    - name: Set Fact
      set_fact:
        netmaskback: "{{ netmaskback }}"

    - name: Set Fact
      set_fact:
        fgtpw: "{{ fgtpw }}"
        


- name: ChangePW
  hosts: fg
  vars:
    ansible_user: admin
    ansible_ssh_common_args: -o StrictHostKeyChecking=no
    ansible_ssh_pass: "{{ hostvars['localhost'].stackinfo.stack_outputs.FortiGateId }}"
  gather_facts: no
  
  tasks:
    - raw: |
        "{{ hostvars['localhost'].fgtpw }}"
        "{{ hostvars['localhost'].fgtpw }}"
        config system interface
          edit port2
            set mode static
            set ip "{{ hostvars['localhost'].stackinfo.stack_outputs.FGIntAddress }}/17"
          next
        end
      tags: pw
    - name: Wait for License Reboot
      pause:
        minutes: 1
        
    - name: Wait for VM to be up
      wait_for:
        host: "{{ inventory_hostname }}"
        port: 22
        state: started
      delegate_to: localhost
      
- name: Local Firewall Config
  hosts: localhost
  connection: local
  gather_facts: no
  vars:
    localfw: 10.0.2.90
    localadmin: admin
    localpw: ""
    vdom: root
    lnet: 10.0.2.0/24
    rnet: 10.100.0.0/17
    remotefw: "{{ stackinfo.stack_outputs.FortiGatepubIp }}"
    localinterface: port1
    psk: "V3ry53cre3tP4w0rd"
    vpnname: elavpn
    
  tasks:

    - name: Get the token with uri
      uri:
        url: https://{{ localfw }}/logincheck
        method: POST
        validate_certs: no
        body: "ajax=1&username={{ localadmin }}&password={{ localpw }}"
      register: uriresult
      tags: gettoken

    - name: Get Token out
      set_fact:
        token: "{{ uriresult.cookies['ccsrftoken'] | regex_replace('\"', '') }}"

    - debug: msg="{{ token }}"

    - name: Phase1 Old Style
      uri:
        url: https://{{ localfw }}/api/v2/cmdb/vpn.ipsec/phase1-interface
        validate_certs: no
        method: POST
        headers:
          X-CSRFTOKEN: "{{ token }}"
          Cookie: "{{ uriresult.set_cookie }}"
        body: "{{ lookup('template', 'forti-phase1.j2') }}"
        body_format: json
      register: answer
      tags: phase1

    - name: Phase2 old style
      uri: 
        url: https://{{ localfw }}/api/v2/cmdb/vpn.ipsec/phase2-interface
        validate_certs: no
        method: POST
        headers:
          X-CSRFTOKEN: "{{ token }}"
          Cookie: "{{ uriresult.set_cookie }}"
        body: "{{ lookup('template', 'forti-phase2.j2') }}"
        body_format: json
      register: answer
      tags: phase2

    - name: Route old Style
      uri:
        url: https://{{ localfw }}/api/v2/cmdb/router/static
        validate_certs: no
        method: POST
        headers:
          Cookie: "{{ uriresult.set_cookie }}"
          X-CSRFTOKEN: "{{ token }}"
        body: "{{ lookup('template', 'fortiroute.j2') }}"
        body_format: json
      register: answer
      tags: route


    - name: Local Object Old Style
      uri:
        url: https://{{ localfw }}/api/v2/cmdb/firewall/address
        validate_certs: no
        method: POST
        headers:
          Cookie: "{{ uriresult.set_cookie }}"
          X-CSRFTOKEN: "{{ token }}"
        body:
          type: ipmask
          name: kubernet
          subnet: "{{ lnet }}"
        body_format: json
      register: answer
      tags: objectlocal

    - name: Remote Object Old Stlye
      uri:
        url: https://{{ localfw }}/api/v2/cmdb/firewall/address
        validate_certs: no
        method: POST
        headers:
          Cookie: "{{ uriresult.set_cookie }}"
          X-CSRFTOKEN: "{{ token }}"
        body:
          type: ipmask
          name: kubernet-remote
          subnet: "{{ rnet }}"
        body_format: json
      register: answer
      tags: objectremote


    - name: Rule-In Old Style
      uri:
        url: https://{{ localfw }}/api/v2/cmdb/firewall/policy
        validate_certs: no
        method: POST
        headers:
          Cookie: "{{ uriresult.set_cookie }}"
          X-CSRFTOKEN: "{{ token }}"
        body:
          name: kub-in
          action: accept
          dstaddr:
            - name: kubernet
          srcaddr:
            - name: kubernet-remote
          srcintf:
            - name: "{{ vpnname }}"
          dstintf:
            - name: "{{ localinterface }}"
          schedule: always
          service:
            - name: ALL
          nat: disable
        body_format: json
      register: answer
      tags: rulein

    - name: Rule-out Old Style
      uri:
        url: https://{{ localfw }}/api/v2/cmdb/firewall/policy
        validate_certs: no
        method: POST
        headers:
          Cookie: "{{ uriresult.set_cookie }}"
          X-CSRFTOKEN: "{{ token }}"
        body:
          name: kubout
          action: accept
          srcaddr:
            - name: kubernet
          dstaddr:
            - name: kubernet-remote
          dstintf:
            - name: "{{ vpnname }}"
          srcintf:
            - name: "{{ localinterface }}"
          schedule: always
          service:
            - name: ALL
          nat: disable          
        body_format: json
      register: answer
      tags: ruleout

- name: Set Facts for new hosts
  hosts: newhosts
  gather_facts: no
  tasks:
    - set_fact: 
        ansible_ssh_user: centos
        masternode: 0
        do_ela: 1


- name: Wait For VPN Tunnel
  hosts: 10.0.2.25
  tasks: 
    - wait_for:
        host: "{{ hostvars['localhost'].stackinfo.stack_outputs.Server1Address }}"
        port: 22
        state: started




- name: Install elastic
  hosts: elahosts
  vars: 
    elaversion: 6
    eladatapath: /elkdata
    ansible_ssh_common_args: -o StrictHostKeyChecking=no

  tasks:

  - ini_file:
      path: /etc/yum.conf
      section: main
      option: ip_resolve
      value: 4
    become: yes
    become_method: sudo
    when: do_ela == 1
    name: Change yum.conf

  - yum:
      name: "*"
      state: "latest"
    name: RHUpdates
    become: yes
    become_method: sudo
    when: do_ela == 1

  - include_role:
      name: matrix.centos-elasticcluster
    vars: 
      clustername: matrixlog
      elaversion: 6
    when: do_ela == 1

  - name: Set Permissions for data
    file:
      path: "{{ eladatapath  }}"
      owner: elasticsearch
      group: elasticsearch
      state: directory
      mode: "4750"
    become: yes
    become_method: sudo
    when: do_ela == 1
          
      
  - systemd:
      name: elasticsearch
      state: restarted
    become: yes
    become_method: sudo
    when: do_ela == 1
