# choose a node for tasks that should only run on (any) one node, e.g. when writing to /etc/pve
- name: Select the primary node
  set_fact:
    is_primary: '{{ nodes is defined and inventory_hostname == (nodes | map(attribute="inventory_hostname") | sort | first) }}'

- name: Set up hosts file
  template:
    dest: /etc/hosts
    src: hosts.j2

- include_tasks: network.yml

- include_tasks: repositories.yml

- name: Set up sysctls
  copy:
    dest: /etc/sysctl.d/local.conf
    src: sysctl.conf

- name: Set domain for ACME certificate renewals
  command:
    cmd: 'pvenode config set --acme domains={{ interfaces | selectattr("name", "==", "lo")
             | map(attribute="ip_addresses") | flatten | map(attribute="dns_name")
             | sort | unique | join(";") }}'
  changed_when: false # maybe write a proper check if certificate requests are ever ansibled

- name: Set SMTP relay
  lineinfile:
    path: /etc/postfix/main.cf
    regexp: '^relayhost ='
    line: 'relayhost = {{ mail_relay | default("") }}'
  notify: reload postfix

- include_tasks: firewall.yml

- include_tasks: user.yml