ansible-roles/roles/unifi/tasks/main.yml

---

- name: Set default install mode to none
  set_fact: unifi_install_mode="none"
  tags: unifi

- name: Install dependencies
  yum:
    name:
      - java-1.8.0-openjdk-headless
      - mongodb-server
  tags: unifi

- name: Create a system account to run unifi
  user:
    name: unifi
    comment: "Unifi system account"
    system: True
    shell: /sbin/nologin
  tags: unifi

- name: Check if unifi is installed
  stat: path={{ unifi_root_dir }}/meta/ansible_version
  register: unifi_version_file
  tags: unifi

- name: Check installed version
  command:  cat {{ unifi_root_dir }}/meta/ansible_version
  register: unifi_current_version
  changed_when: False
  when: unifi_version_file.stat.exists
  tags: unifi

- name: Set install mode to install
  set_fact: unifi_install_mode='install'
  when: not unifi_version_file.stat.exists
  tags: unifi

- name: Set install mode to upgrade
  set_fact: unifi_install_mode='upgrade'
  when:
    - unifi_version_file.stat.exists
    - unifi_current_version is defined
    - unifi_current_version.stdout != unifi_version
    - unifi_manage_upgrade == True
  tags: unifi

- name: Create archive directory
  file: path={{ unifi_root_dir }}/archives/{{ unifi_current_version.stdout }} state=directory
  when: unifi_install_mode == 'upgrade'
  tags: unifi

- name: Stop the service
  service: name=unifi state=stopped
  when: unifi_install_mode == 'upgrade'
  tags: unifi

- name: Archive current version
  synchronize:
    src: "{{ unifi_root_dir }}/app"
    dest: "{{ unifi_root_dir }}/archives/{{ unifi_current_version.stdout }}/"
    recursive: True
    delete: True
  delegate_to: "{{ inventory_hostname }}"
  when: unifi_install_mode == 'upgrade'
  tags: unifi

- name: Create directories
  file: path={{ unifi_root_dir }}/{{ item.path }} state=directory owner={{ item.owner | default(omit) }} group={{ item.group | default(omit) }} mode={{ item.mode | default(omit) }}
  with_items:
    - path: tmp
    - path: app
      owner: unifi
      group: unifi
    - path: 'app/data'
      owner: unifi
      group: unifi
      mode: 700
    - path: meta
    - path: archives
    - path: backup
      owner: unifi
      group: unifi
      mode: 700
  tags: unifi

- name: Download unifi archive
  get_url:
    url: "{{ unifi_archive_url }}"
    dest: "{{ unifi_root_dir }}/tmp"
    checksum: "sha1:{{ unifi_archive_sha1 }}"
  when: unifi_install_mode != 'none'
  tags: unifi

- name: Extract Unifi
  unarchive:
    src: "{{ unifi_root_dir }}/tmp/UniFi.unix.zip"
    dest: "{{ unifi_root_dir }}/tmp"
    owner: unifi
    group: unifi
    remote_src: True
  when: unifi_install_mode != 'none'
  tags: unifi

- name: Move unifi to its final directory
  synchronize:
    src: "{{ unifi_root_dir }}/tmp/UniFi/{{ item }}"
    dest: "{{ unifi_root_dir }}/app/"
    delete: True
    recursive: True
  with_items:
    - bin
    - conf
    - dl
    - lib
    - webapps
  delegate_to: "{{ inventory_hostname }}"
  when: unifi_install_mode != 'none'
  tags: unifi

- name: Handle unifi HTTP ports
  iptables_raw:
    name: unifi_http_ports
    state: "{{ (unifi_http_src_ip | length > 0) | ternary('present','absent') }}"
    rules: "-A INPUT -m state --state NEW -p tcp -m multiport --dports {{ unifi_http_ports | join(',') }} -s {{ unifi_http_src_ip | join(',') }} -j ACCEPT"
  when: iptables_manage | default(True)
  tags: [firewall,unifi]

- name: Handle unifi STUN ports
  iptables_raw:
    name: unifi_stun_ports
    state: "{{ (unifi_stun_src_ip | length > 0) | ternary('present','absent') }}"
    rules: "-A INPUT -m state --state NEW -p udp -m multiport --dports {{ unifi_stun_ports | join(',') }} -s {{ unifi_stun_src_ip | join(',') }} -j ACCEPT"
  when: iptables_manage | default(True)
  tags: [firewall,unifi]

- name: Check if a config file already exists
  stat: path={{ unifi_root_dir }}/app/data/system.properties
  register: unifi_config
  tags: unifi

- name: Init config file
  copy: content="is_default=true" dest={{ unifi_root_dir }}/app/data/system.properties owner=unifi group=unifi mode=640
  when: not unifi_config.stat.exists
  tags: unifi

- name: Configure UniFi Controller
  lineinfile:
    path: "{{ unifi_root_dir }}/app/data/system.properties"
    regexp: "^{{ item.option }}.*"
    line: "{{ item.option }}={{ item.value }}"
  with_items:
    - option: unifi.xmx
      value: 4096
    - option: unifi.xms
      value: 4096
    - option: unifi.G1GC.enabled
      value: 'true'
    - option: autobackup.dir
      value: "{{ unifi_root_dir }}/backup"
    - option: unifi.http.port
      value: "{{ unifi_http_port }}"
    - option: unifi.https.port
      value: "{{ unifi_https_port }}"
    - option: portal.http.port
      value: "{{ unifi_portal_http_port }}"
    - option: portal.https.port
      value: "{{ unifi_portal_https_port }}"
    - option: uuid
      value: "{{ inventory_hostname | to_uuid }}"
  notify: restart unifi
  tags: unifi

- name: Deploy unit file
  template: src=unifi.service.j2 dest=/etc/systemd/system/unifi.service
  notify: restart unifi
  register: unifi_unit
  tags: unifi

- name: Reload systemd
  command: systemctl daemon-reload
  when: unifi_unit.changed
  tags: unifi

- name: Start and enable the service
  service: name=unifi state=started enabled=True
  tags: unifi

- name: Compress previous version
  command: tar cJf {{ unifi_root_dir }}/archives/{{ unifi_current_version.stdout }}.txz ./
  environment:
    XZ_OPT: -T0
  args:
    chdir: "{{ unifi_root_dir }}/archives/{{ unifi_current_version.stdout }}"
    warn: False
  when: unifi_install_mode == 'upgrade'
  tags: unifi

- name: Remove archive dir
  file: path={{ unifi_root_dir }}/archives/{{ unifi_current_version.stdout }} state=absent
  when: unifi_install_mode == 'upgrade'
  tags: unifi

- name: Remove temp files
  file: path={{ item }} state=absent
  loop:
    - "{{ unifi_root_dir }}/tmp/UniFi.unix.zip"
    - "{{ unifi_root_dir }}/tmp/UniFi"
  tags: unifi

- name: Write version installed
  copy: content={{ unifi_version }} dest={{ unifi_root_dir }}/meta/ansible_version
  tags: unifi

- include: filebeat.yml