---
# Everything, in the order it has to happen.
#
# This file is a TABLE OF CONTENTS, not a second source of truth. It says what
# runs and in what order. It does NOT say which hosts get what — that stays on
# the `hosts:` line inside each playbook, exactly where it is today. Nothing
# moves; this file only makes the set readable in one place.
#
#   What runs on a host?   ansible-playbook site.yml --limit <host> --list-hosts
#   Who gets thing Y?      the `hosts:` line in Y's own playbook
#   What is a host?        ansible-inventory --graph
#
# Run a slice with --limit, or run one playbook directly as before. Nothing here
# changes how any individual playbook behaves.

# ── Baseline: every managed machine ─────────────────────────────────────────
- import_playbook: infra/01_user_and_access_setup_playbook.yml
- import_playbook: infra/02_firewall_and_fail2ban_playbook.yml
- import_playbook: infra/900_install_rsync.yml
- import_playbook: infra/920_join_headscale_mesh.yml
# 910_docker says `hosts: managed`, but only 5 of 11 managed hosts have or need
# Docker. Left out until it has a [docker] group — see the note in PLAN_7.

# ── The hypervisor ──────────────────────────────────────────────────────────
- import_playbook: infra/nodito/31_proxmox_community_repos_playbook.yml
- import_playbook: infra/nodito/32_zfs_pool_setup_playbook.yml
- import_playbook: infra/nodito/34_nut_ups_setup_playbook.yml

# ── Reverse proxy, before anything that registers a vhost ───────────────────
- import_playbook: services/caddy_playbook.yml

# ── Services ────────────────────────────────────────────────────────────────
- import_playbook: services/bitcoin-knots/deploy_bitcoin_knots_playbook.yml
- import_playbook: services/fulcrum/deploy_fulcrum_playbook.yml
- import_playbook: services/datum-gateway/deploy_datum_gateway_playbook.yml
- import_playbook: services/mempool/deploy_mempool_playbook.yml
- import_playbook: services/memos/deploy_memos_playbook.yml
- import_playbook: services/forgejo-runner/deploy_forgejo_runner_playbook.yml
- import_playbook: services/phoenixd/deploy_phoenixd_playbook.yml
- import_playbook: services/headscale/deploy_headscale_playbook.yml
- import_playbook: services/vaultwarden/deploy_vaultwarden_playbook.yml
- import_playbook: services/forgejo/deploy_forgejo_playbook.yml
- import_playbook: services/lnbits/deploy_lnbits_playbook.yml
- import_playbook: services/ntfy/deploy_ntfy_playbook.yml
- import_playbook: services/ntfy-emergency-app/deploy_ntfy_emergency_app_playbook.yml
- import_playbook: services/personal-blog/deploy_personal_blog_playbook.yml

# ── Backups: each source dumps itself, the box pulls ────────────────────────
- import_playbook: services/headscale/setup_backup_headscale.yml
- import_playbook: services/vaultwarden/setup_backup_vaultwarden.yml
- import_playbook: services/forgejo/setup_backup_forgejo.yml
- import_playbook: services/lnbits/setup_backup_lnbits.yml
- import_playbook: services/memos/setup_backup_memos.yml
- import_playbook: playbooks/backups.yml

# Deliberately not here. Every playbook in the repo is either imported above or
# listed below, so this file accounts for all of them:
#
#   infra/410_disk_usage_alerts.yml     assert on the Uptime Kuma credentials that
#   infra/420_system_healthcheck.yml    were removed from the vault, so they fail
#   infra/430_cpu_temp_alerts.yml       before doing anything. What they deploy IS
#                                       running on the boxes - same state the two
#                                       nodito playbooks were in before 0f03c50.
#                                       Add them once they are de-Kuma'd.
#
#   infra/910_docker_playbook.yml       says `hosts: managed`, but Docker is on 5
#                                       of 11 managed hosts and those 5 are exactly
#                                       the ones that need it. Running it would
#                                       install Docker on the Bitcoin node and the
#                                       hypervisor. Needs a [docker] group first.
#
#   infra/nodito/30_proxmox_bootstrap   one-shot: bare-metal bootstrap, run once
#   infra/nodito/33_..._cloud_template  one-shot: builds the VM template
#
#   services/ntfy/setup_ntfy_uptime_    creates a notification channel INSIDE
#     kuma_notification.yml             Uptime Kuma. Kuma-specific tooling, not
#                                       a deployment.
#
#   services/vaultwarden/disable_       deliberate manual actions, not convergence
#     vaultwarden_sign_ups_playbook.yml
#   services/personal-blog/setup_
#     deploy_alias_lapy.yml