personal_infra/ansible/roles/socket_proxy/tasks/main.yml

---
- name: Assert socket_proxy parameters are sane
  ansible.builtin.assert:
    that:
      - socket_proxy_name | length > 0
      - socket_proxy_description | length > 0
      - socket_proxy_listen_port | int > 0
      - socket_proxy_upstream_host | length > 0
    fail_msg: >-
      socket_proxy: '{{ socket_proxy_name | default("<unnamed>") }}' needs a name,
      a description, a listen port and an upstream host.
    quiet: true

- name: "Create the {{ socket_proxy_name }}-proxy socket unit"
  ansible.builtin.template:
    src: proxy.socket.j2
    dest: "/etc/systemd/system/{{ socket_proxy_name }}-proxy.socket"
    owner: root
    group: root
    mode: '0644'
  notify: Restart socket proxy

- name: "Create the {{ socket_proxy_name }}-proxy service unit"
  ansible.builtin.template:
    src: proxy.service.j2
    dest: "/etc/systemd/system/{{ socket_proxy_name }}-proxy.service"
    owner: root
    group: root
    mode: '0644'
  notify: Restart socket proxy

- name: "Enable and start the {{ socket_proxy_name }}-proxy socket"
  ansible.builtin.systemd:
    name: "{{ socket_proxy_name }}-proxy.socket"
    enabled: yes
    state: started
    daemon_reload: yes

- name: "Allow the {{ socket_proxy_name }} port through UFW"
  community.general.ufw:
    rule: allow
    port: "{{ socket_proxy_listen_port | string }}"
    proto: "{{ socket_proxy_ufw_proto }}"
    comment: "{{ socket_proxy_ufw_comment | default(socket_proxy_description ~ ' public access', true) }}"

# Reachability of the upstream over Tailscale. Deliberately non-fatal: the proxy
# is still correctly configured if the backend happens to be down, and this is
# the one check that depends on another machine being up.
- name: "Verify {{ socket_proxy_upstream_host }} is reachable over Tailscale"
  ansible.builtin.wait_for:
    host: "{{ socket_proxy_upstream_host }}"
    port: "{{ socket_proxy_upstream_port | default(socket_proxy_listen_port, true) }}"
    timeout: 10
  failed_when: false