- assert:
    that:
      - wordpress_uid is defined
      - wordpress_service_type is defined
      - wordpress_db_name is defined
      - wordpress_port is defined
      - wordpress_distributed is defined

- name: create wordpress user
  user:
    system: yes
    createhome: yes
    shell: /bin/false
    uid: "{{wordpress_uid}}"
    name: wordpress
  become: yes
  register: uid

- name: find DB
  set_fact:
    db: "{{item}}"
    db_id: "{{item.target.split('.')[0]}}"
    db_user: "{{vpc_name}}"
    db_endpoint:
      Address: "{{item.target}}"
      Port: "{{item.port}}"
  with_items: "{{lookup('dig','_mysql._'+wordpress_service_type+'.service.consul./SRV','flat=0',wantlist=True)}}"
  delegate_to: 127.0.0.1

- name: create wordpress db
  local_action:
    module: mysql_db
    collation: "utf8_general_ci"
    encoding: utf8
    name: "{{ wordpress_db_name }}"
    login_user: "{{ db_user }}"
    login_host: "{{ db_endpoint.Address }}"
    login_password: "{{ lookup('password' ,lookup('env','ANSIBLE_DATA')+'/passwords/rds/'+db_id) }}"
    login_port: "{{ db_endpoint.Port }}"
  run_once: true

- name: create wordpress db user
  local_action:
    module: mysql_user
    name: "{{ wordpress_db_name }}"
    login_user: "{{ db_user }}"
    login_host: "{{ db_endpoint.Address }}"
    login_password: "{{ lookup('password' ,lookup('env','ANSIBLE_DATA')+'/passwords/rds/'+db_id) }}"
    password: "{{ lookup('password' ,lookup('env','ANSIBLE_DATA')+'/passwords/rds/db/'+db_id+'/'+wordpress_db_name + ' chars=ascii_letters,digits,hexdigits')}}"
    login_port: "{{ db_endpoint.Port }}"
    priv: "{{wordpress_db_name}}.*:ALL"
    host: "%"
  run_once: true

- name: create wordpress glusterfs directory for data volume
  file: path=/var/data/glusterfs/volumes/wordpress/var/www/html state=directory mode=755 owner=wordpress group=wordpress
  become: yes
  when: wordpress_distributed

- name: create wordpress local directory
  file: path=/var/data/wordpress/local/wp-admin state=directory mode=755 owner=wordpress group=wordpress
  become: yes
  when: wordpress_distributed

- name: launch distributed docker wordpress data image
  docker:
    name: wordpress-data
    image: "{{wordpress_image}}"
    state: present
    insecure_registry: yes
    command: /bin/true
    volumes:
      - /var/data/glusterfs/volumes/wordpress/var/www/html:/var/www/html
      - /var/data/wordpress/local:/var/www/local
    pull: always
  become: yes
  when: wordpress_distributed

- name: launch docker wordpress data image
  docker:
    name: wordpress-data
    image: "{{wordpress_image}}"
    state: present
    insecure_registry: yes
    command: /bin/true
    pull: always
  become: yes
  when: not wordpress_distributed

- name: launch docker wordpress image
  docker:
    name: wordpress
    labels:
      AthenaServiceName: "wordpress"
      AthenaLogType: generic1
    image: "{{wordpress_image}}"
    state: reloaded
    net: "{{docker_network_name}}"
    detach: true
    insecure_registry: yes
    restart_policy: always
    pull: always
    volumes_from:
      - wordpress-data
    env:
      WORDPRESS_DB_HOST: "{{ db_endpoint.Address }}"
      WORDPRESS_DB_NAME: "{{ wordpress_db_name }}"
      WORDPRESS_DB_USER: "{{ wordpress_db_name }}"
      WORDPRESS_DB_PASSWORD: "{{ lookup('password' ,lookup('env','ANSIBLE_DATA')+'/passwords/rds/db/'+db_id+'/'+wordpress_db_name) }}"
    ports:
      - "{{ wordpress_port }}:80"
  become: yes

- name: upload site root htaccess file
  template:
    dest: "/var/data/wordpress/local/.htaccess"
    force: yes
    src: htaccess-root.j2
    owner: wordpress
    group: wordpress
  become: yes
  when: wordpress_distributed

- name: upload deny folder access htaccess file
  template:
    dest: "/var/data/wordpress/local/wp-admin/.htaccess"
    force: yes
    src: htaccess-deny.j2
    owner: wordpress
    group: wordpress
  become: yes
  when: wordpress_distributed

- name: upload wp-config.php
  template:
    dest: "/var/data/wordpress/local/wp-config.php"
    force: yes
    src: wp-config.php.j2
    owner: wordpress
    group: wordpress
  become: yes
  when: wordpress_distributed

- name: remove wordpress authoring capability
  docker:
    name: busybox
    image: busybox
    log_driver: json-file
    detach: False
    command: >
      sh -c '
      rm /var/www/html/.htaccess &&
      ln -s /var/www/local/.htaccess /var/www/html/.htaccess &&
      rm /var/www/html/wp-admin/.htaccess &&
      ln -s /var/www/local/wp-admin/.htaccess /var/www/html/wp-admin/.htaccess &&
      rm /var/www/html/wp-config.php &&
      ln -s /var/www/local/wp-config.php /var/www/html/wp-config.php
      '
    volumes_from:
      - wordpress-data
  become: yes
  when: wordpress_distributed

- name: check if http service is up
  local_action: "wait_for host={{ inventory_hostname }} port={{wordpress_port}} delay=1 timeout=300"
  when: wordpress_service_type == 'Backoffice'

- name: register service
  consul:
    service_name: "wordpress"
    service_port: "{{wordpress_port}}"
    script: "nc -vz {{ec2_private_ip_address}} {{wordpress_port}}"
    interval: "5s"
    port: "{{consul_api_port}}"
    tags:
      - http

- name: register service
  consul:
    service_name: "wordpresselb"
    service_port: "{{wordpress_port}}"
    script: "nc -vz {{ec2_private_ip_address}} {{wordpress_port}}"
    interval: "5s"
    port: "{{consul_api_port}}"
    tags:
      - elb
  when: wordpress_service_type == 'Public'

{% if wordpress_service_type == 'Public' %}

SetEnvIfExpr "%{REQUEST_URI} =~ m#/wp-admin/admin-ajax\.php$# && %{QUERY_STRING} =~ m#^action=inwave_color.*$#" uriok=1
Order Deny,Allow
Deny from all
Allow from env=uriok

{% endif %}

# BEGIN WordPress
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteBase /
RewriteRule ^index\.php$ - [L]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]
</IfModule>

# END WordPress

{% if wordpress_service_type == 'Public' %}
<IfModule mod_rewrite.c>

RewriteEngine On
RewriteCond %{HTTP:X-Forwarded-Proto} !https
RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

RewriteCond %{REQUEST_URI} wp-login
RewriteRule . / [R,L]
</IfModule>

Options -Indexes
{% endif %}

wordpress_port: 10980

wordpress_uid: 10017

# Wordpress database name
wordpress_db_name: wordpress 

# Deploy Wordpress service
deploy_service_wordpress: false

# Deploy wordpress on multiple nodes
wordpress_distributed: false

# Wordpress version
wordpress_image: "{{docker_registry_host}}/athena-wordpress:{{platform_version}}"

# Docker images backup list (with other images removed)
docker_images_backup_list:
  - athena-wordpress:{{platform_version}}

# Wordpress Gluster Volume host discovery
- hosts: Public:Backoffice
  user: "{{host_user}}"
  roles:
    - 
      role: defaults
      tags: 
        - glusterfs
    - 
      role: set-service
      service_name: wordpress
      service_port: "{{gluster_daemon_port}}"
      service_tag: gluster
      tags: 
        - glusterfs
    - 
      role: glusterfs-volume
      glusterfs_name: wordpress
      tags: 
        - glusterfs

# Deploy worpress on public nodes
- hosts: Public
  user: "{{host_user}}"
  roles:
    - 
      role: defaults
      tags: 
        - wordpress
    - 
      role: wordpress
      wordpress_service_type: Public
      tags: 
        - wordpress

# Main Backoffice play (with other Backoffice roles not included)
- hosts: Backoffice
  user: "{{host_user}}"
  roles:
    - 
      role: defaults
      tags: 
...
        - wordpress 
...
    -
       role: wordpress
      wordpress_service_type: Backoffice
      tags: 
        - wordpress
...

- name: create Backoffice security group
  local_action:
    module: ec2_group
    name: "{{vpc_name}}{{vpc_env}}Backoffice"
    description: "Backoffice security group"
    vpc_id: "{{vpc.vpc_id}}"
    region: "{{vpc_region}}"
    purge_rules: true
    rules:
...
      - proto: tcp 
        from_port: "{{wordpress_port}}"
        to_port: "{{wordpress_port}}"
        cidr_ip: "{{ vpc_cidr }}.0.0/16"
...

- name: create Public security group
  local_action:
    module: ec2_group
    name: "{{vpc_name}}{{vpc_env}}Public"
    description: "Public security group"
    vpc_id: "{{vpc.vpc_id}}"
    region: "{{vpc_region}}"
    purge_rules: true
    rules:
...
      - proto: tcp 
        from_port: "{{wordpress_port}}"
        to_port: "{{wordpress_port}}"
        cidr_ip: "{{ vpc_cidr }}.0.0/16"
...