---
- hosts: phy_z_srv_cloud
  become: yes
  vars_files:
    - "group_vars/secrets.yml"

  pre_tasks:
    - name: Update apt cache.
      apt:
        update_cache: true
        cache_valid_time: 3600
      when: ansible_os_family == 'Debian'

  roles:
    #    - role: geerlingguy.security
    - role: nextcloud
    - role: smtp_nextcloud
      tags: mail


- hosts: phy_z_dmz_sftp01
  become: yes
  vars_files:
    - "group_vars/secrets.yml"

  pre_tasks:
    - name: Update apt cache.
      apt:
        update_cache: true
        cache_valid_time: 3600
      when: ansible_os_family == 'Debian'

  roles:
    - role: geerlingguy.security
      tags: base


- hosts: phy_z_srv_jira
  become: yes
  vars_files:
    - "group_vars/secrets.yml"

  pre_tasks:
    - name: Update apt cache.
      apt:
        update_cache: true
        cache_valid_time: 3600
      when: ansible_os_family == 'Debian'

  roles:
    - role: geerlingguy.security
      tags: base


- hosts: phy_z_srv_git
  become: yes
  vars_files:
    - "group_vars/secrets.yml"

  pre_tasks:
    - name: Update apt cache.
      apt:
        update_cache: true
        cache_valid_time: 3600
      when: ansible_os_family == 'Debian'

  roles:
    - role: geerlingguy.security
      tags: base


- hosts: phy_z_srv_gpu01
  become: yes
  vars_files:
    - "group_vars/secrets.yml"

  pre_tasks:
    - name: Update apt cache.
      apt:
        update_cache: true
        cache_valid_time: 3600
      when: ansible_os_family == 'Debian'

  roles:
    - role: geerlingguy.security
      tags: base
    - role: geerlingguy.docker
      tags: docker
    - role: nvidia_gpu
      tags: gpu