---
# playbook.yml
- name: "Provision Image"
  hosts: default
  become: True

  roles:
    - role: gdb.aws
      vars:
        aws_profiles:
          - profile_name: 'gdb-delphi-dev'
            role_arn: 'arn:aws:iam::475275892927:role/cross_account_terraform_role'
          - profile_name: 'gdb-delphi-prod'
            role_arn: 'arn:aws:iam::323555055331:role/cross_account_terraform_role'
          - profile_name: 'gdb-core-dev'
            role_arn: 'arn:aws:iam::582412345909:role/cross_account_terraform_role'
          - profile_name: 'gdb-core-prod'
            role_arn: 'arn:aws:iam::885200931856:role/cross_account_terraform_role'
          - profile_name: 'gdb-databricks-dev'
            role_arn: 'arn:aws:iam::745243859288:role/cross_account_terraform_role'
          - profile_name: 'gdb-databricks-prod'
            role_arn: 'arn:aws:iam::807702934854:role/cross_account_terraform_role'
          - profile_name: 'gdb-infra-dev'
            role_arn: 'arn:aws:iam::483193324480:role/cross_account_terraform_role'
          - profile_name: 'gdb-infra-prod'
            role_arn: 'arn:aws:iam::890208661333:role/cross_account_terraform_role'
          - profile_name: 'gdb-apollo-dev'
            role_arn: 'arn:aws:iam::725764004555:role/cross_account_terraform_role'
          - profile_name: 'gdb-apollo-prod'
            role_arn: 'arn:aws:iam::801577982711:role/cross_account_terraform_role'
          - profile_name: 'gdb-prodhub-dev'
            role_arn: 'arn:aws:iam::703740486246:role/cross_account_terraform_role'
          - profile_name: 'gdb-whitelist-legacy'
            role_arn: 'arn:aws:iam::322697034778:role/cross_account_terraform_role'
            region: 'eu-west-1'
    - role: migibert.terraform
      vars:
        terraform_version: "1.5.1"
    - role: geerlingguy.swap
      swap_file_size_mb: '8192'

  tasks:
    - name: Update all packages
      yum:
        name: "*"
        state: latest
        update_only: yes

    - name: Install packages
      yum:
        name: "{{ packages }}"
        state: latest
        update_cache: yes
      vars:
        packages:
          - git
          - jq
          - python-pip
          - yum-utils
          - mailcap
          - amazon-linux-extras
          - java-17-amazon-corretto

    - name: Add extras repository
      shell: yum-config-manager --enable extras

    - name: Set java to correct version
      alternatives:
        name: java
        path: "/usr/lib/jvm/java-17-amazon-corretto.x86_64/bin/java"

    # The stock Amazon Linux 2 AMI ships yum-cron enabled, which runs an
    # automatic OS update on first boot. That upgrades the live JVM out from
    # under a connected agent and drops the Jenkins connection. Disable it and
    # lock Corretto so runtime updates can never swap the JVM on a live agent.
    - name: Disable automatic OS updates (yum-cron) if present
      service:
        name: yum-cron
        state: stopped
        enabled: no
      register: yum_cron_disable
      failed_when:
        - yum_cron_disable is failed
        - "'Could not find the requested service' not in yum_cron_disable.msg"

    - name: Install yum versionlock plugin
      yum:
        name: yum-plugin-versionlock
        state: present

    - name: Lock Corretto so runtime updates can't swap the JVM
      command: yum versionlock java-17-amazon-corretto
      args:
        creates: /etc/yum/pluginconf.d/versionlock.list