potato-infra/playbooks/site.yml

---
- name: Provision Potato Server Infrastructure
  hosts: potato
  become: true

  tasks:
    - name: Update apt cache
      apt:
        update_cache: yes
        cache_valid_time: 3600

    - name: Install System Dependencies
      apt:
        name:
          - cockpit
          - nginx
          - certbot
          - python3-certbot-nginx
          - git
        state: present

    # --- FORGEJO SYSTEM USER & DIRECTORIES ---
    - name: Create Git system user for Forgejo
      user:
        name: git
        home: /home/git
        shell: /bin/bash
        system: yes

    - name: Create Forgejo application directories
      file:
        path: "{{ item }}"
        state: directory
        owner: git
        group: git
        mode: '0750'
      loop:
        - /var/lib/forgejo
        - /var/lib/forgejo/data
        - /var/lib/forgejo/custom
        - /var/lib/forgejo/log
        - /etc/forgejo

    # --- FORGEJO BINARY INSTALLATION ---
    - name: Download Forgejo Linux AMD64 binary
      get_url:
        url: "https://codeberg.org/forgejo/forgejo/releases/download/v{{ forgejo_version }}/forgejo-{{ forgejo_version }}-linux-amd64"
        dest: /usr/local/bin/forgejo
        mode: '0755'
        owner: root
        group: root

    - name: Provision Forgejo Systemd Service Unit
      copy:
        dest: /etc/systemd/system/forgejo.service
        content: |
          [Unit]
          Description=Forgejo (Git Service)
          After=syslog.target
          After=network.target
          After=postgresql.service

          [Service]
          Type=simple
          User=git
          Group=git
          WorkingDirectory=/var/lib/forgejo/
          Environment=USER=git HOME=/home/git FORGEJO_WORK_DIR=/var/lib/forgejo
          ExecStart=/usr/local/bin/forgejo web --config /etc/forgejo/app.ini
          Restart=always
          RestartSec=2s

          [Install]
          WantedBy=multi-user.target

    # --- SERVICE MANAGEMENT ---
    - name: Enable and start system infrastructure services
      service:
        name: "{{ item }}"
        state: started
        enabled: yes
      loop:
        - cockpit
        - nginx
        - forgejo
    # Install System Dependencies for Nginx and Certbot    
    - name: Remove default Nginx site configuration
      file:
        path: /etc/nginx/sites-enabled/default
        state: absent

    - name: Reload Nginx to apply changes
      service:
        name: nginx
        state: reloaded