---
- name: Create Cloud Infra
  hosts: localhost
  gather_facts: false

  vars:
    aws_vpc_name: aws-test-vpc
    aws_owner_tag: default
    aws_purpose_tag: ansible_demo
    aws_tenancy: default
    aws_vpc_cidr_block: 10.0.0.0/16
    aws_subnet_cidr: 10.0.1.0/24
    aws_sg_name: aws-test-sg
    aws_subnet_name: aws-test-subnet
    aws_rt_name: aws-test-rt

    # map of availability zones to use per region, added since not all
    # instance types are available in all AZs.  must match the drop-down
    # list for the create_vm_aws_region variable described in cloud/setup.yml
    _azs:
      us-east-1:
        - us-east-1a
        - us-east-1b
        - us-east-1c
      us-east-2:
        - us-east-2a
        - us-east-2b
        - us-east-2c
      us-west-1:
        # us-west-1a not available when last checked 20250218
        - us-west-1b
        - us-west-1c
      us-west-2:
        - us-west-2a
        - us-west-2b
        - us-west-2c

  tasks:
    - name: Create VPC
      amazon.aws.ec2_vpc_net:
        state: present
        name: "{{ aws_vpc_name }}"
        cidr_block: "{{ aws_vpc_cidr_block }}"
        tenancy: "{{ aws_tenancy }}"
        region: "{{ create_vm_aws_region }}"
        tags:
          owner: "{{ aws_owner_tag }}"
          purpose: "{{ aws_purpose_tag }}"
      register: aws_vpc

    - name: Create internet gateway
      amazon.aws.ec2_vpc_igw:
        state: present
        vpc_id: "{{ aws_vpc.vpc.id }}"
        region: "{{ create_vm_aws_region }}"
        tags:
          Name: "{{ aws_vpc_name }}"
          owner: "{{ aws_owner_tag }}"
          purpose: "{{ aws_purpose_tag }}"
      register: aws_gateway

    - name: Create security group internal
      amazon.aws.ec2_security_group:
        state: present
        name: "{{ aws_sg_name }}"
        region: "{{ create_vm_aws_region }}"
        description: Inbound WinRM and RDP, http for demo servers and internal AD ports
        rules:
          - proto: tcp
            ports:
              - 80  # HTTP
              - 443  # HTTPS
              - 22  # SSH
              - 5986  # WinRM
              - 3389  # RDP
              - 9090  # Cockpit
            cidr_ip: 0.0.0.0/0
          - proto: icmp
            to_port: -1
            from_port: -1
            cidr_ip: 0.0.0.0/0
          - proto: tcp
            ports:
              - 80  # HTTP
              - 5986  # WinRM
              - 3389  # RDP
              - 53  # DNS
              - 88  # Kerberos Authentication
              - 135  # RPC
              - 139  # Netlogon
              - 389  # LDAP
              - 445  # SMB
              - 464  # Kerberos Authentication
              - 5432  # PostgreSQL
              - 636  # LDAPS (LDAP over TLS)
              - 873  # Rsync
              - 3268-3269  # Global Catalog
              - 1024-65535  # Ephemeral RPC ports
            cidr_ip: "{{ aws_vpc_cidr_block }}"
          - proto: udp
            ports:
              - 53  # DNS
              - 88  # Kerberos Authentication
              - 123  # NTP
              - 137-138  # Netlogon
              - 389  # LDAP
              - 445  # SMB
              - 464  # Kerberos Authentication
              - 1024-65535  # Ephemeral RPC ports
            cidr_ip: "{{ aws_vpc_cidr_block }}"
        rules_egress:
          - proto: -1
            cidr_ip: 0.0.0.0/0
        vpc_id: "{{ aws_vpc.vpc.id }}"
        tags:
          Name: "{{ aws_sg_name }}"
          owner: "{{ aws_owner_tag }}"
          purpose: "{{ aws_purpose_tag }}"

    - name: Create a subnet in the VPC
      amazon.aws.ec2_vpc_subnet:
        state: present
        vpc_id: "{{ aws_vpc.vpc.id }}"
        cidr: "{{ aws_subnet_cidr }}"
        region: "{{ create_vm_aws_region }}"
        az: "{{ _azs[create_vm_aws_region] | shuffle | first }}"
        map_public: true
        tags:
          Name: "{{ aws_subnet_name }}"
          owner: "{{ aws_owner_tag }}"
          purpose: "{{ aws_purpose_tag }}"
      register: aws_subnet

    - name: Create a subnet route table
      amazon.aws.ec2_vpc_route_table:
        state: present
        vpc_id: "{{ aws_vpc.vpc.id }}"
        region: "{{ create_vm_aws_region }}"
        subnets:
          - "{{ aws_subnet.subnet.id }}"
        routes:
          - dest: 0.0.0.0/0
            gateway_id: "{{ aws_gateway.gateway_id }}"
        tags:
          Name: "{{ aws_rt_name }}"
          owner: "{{ aws_owner_tag }}"
          purpose: "{{ aws_purpose_tag }}"

    - name: Set VPC stats
      ansible.builtin.set_stats:
        data:
          stat_aws_region: '{{ create_vm_aws_region }}'
          stat_aws_vpc_id: '{{ aws_vpc.vpc.id }}'
          stat_aws_vpc_cidr: '{{ aws_vpc_cidr_block }}'
          stat_aws_subnet_id: '{{ aws_subnet.subnet.id }}'
          stat_aws_subnet_cidr: '{{ aws_subnet_cidr }}'
