---
# Jumphost-Deployment. Siehe Konzeptdokument Kap. 7 fuer Hintergrund.
#
# Steuerung ueber group_vars:
#   enable_nginx_proxy: true|false   (Kap. 7.2)
#   tls_mode: internal_pki | external_reverse_proxy | acme_public  (Kap. 7.2a)

- hosts: jumphosts
  become: true
  vars_files:
    - inventory/group_vars/all.yml
  roles:
    - os_hardening
    - firewall_nftables
    - fail2ban
    - frontend_assets   # baut static/js/vendor/* lokal VOR dem Sync in python_runtime
    - python_runtime
    - sqlite_init
    - guacd
    - jumphost_app
    - tls_certificates
    - { role: nginx_proxy, when: enable_nginx_proxy | default(false) }
    - backup