---
- hosts: phy_z_srv_cloud
  become: yes
  vars_files:
    - "group_vars/secrets.yml"

  pre_tasks:
    - name: Update apt cache.
      apt:
        update_cache: true
        cache_valid_time: 3600
      when: ansible_os_family == 'Debian'

  roles:
    #    - role: geerlingguy.security
    - role: nextcloud
    - role: smtp_nextcloud
      tags: mail


- hosts: phy_z_dmz_sftp01
  become: yes
  vars_files:
    - "group_vars/secrets.yml"

  pre_tasks:
    - name: Update apt cache.
      apt:
        update_cache: true
        cache_valid_time: 3600
      when: ansible_os_family == 'Debian'

  roles:
    - role: geerlingguy.security
      tags: base


- hosts: phy_z_srv_jira
  become: yes
  vars_files:
    - "group_vars/secrets.yml"

  pre_tasks:
    - name: Update apt cache.
      apt:
        update_cache: true
        cache_valid_time: 3600
      when: ansible_os_family == 'Debian'

  roles:
    - role: geerlingguy.security
      tags: base


- hosts: phy_z_srv_git
  become: yes
  vars_files:
    - "group_vars/secrets.yml"

  pre_tasks:
    - name: Update apt cache.
      apt:
        update_cache: true
        cache_valid_time: 3600
      when: ansible_os_family == 'Debian'

  roles:
    - role: geerlingguy.security
      tags: base


- hosts: phy_srv_gpu01
  become: yes
  vars_files:
    - "group_vars/secrets.yml"

  pre_tasks:
    - name: Update apt cache.
      apt:
        update_cache: true
        cache_valid_time: 3600
      when: ansible_os_family == 'Debian'

  roles:
    - role: geerlingguy.security
      tags: base
    - role: geerlingguy.docker
      tags: docker
    - role: nvidia_gpu
      tags: gpu
    # renders services/phy-srv-gpu01/*/compose.yml into ~/docker/compose.yaml.
    # It only WRITES the file — starting the stack stays a deliberate manual
    # step (see ansible/services/phy-srv-gpu01/README.md).
    - role: ironicbadger.docker_compose_generator
      tags: compose