---
- import_playbook: "include/deploy-kvm-guest.yml myhosts=munin"

- name: configure instance
  hosts: munin
  user: root
  gather_facts: true

  pre_tasks:
    - name: mount /export
      mount:
        name: /export
        src: LABEL=/export
        fstype: xfs
        opts: noatime,noexec,nosuid,nodev
        passno: "0"
        dump: "0"
        state: mounted

  vars_files:
    - "{{ ansible_private }}/vars.yml"

  roles:
    - base
    - mod_auth_gssapi
    - role: keytab
      keytab: /etc/httpd/httpd.keytab
      principals: HTTP/munin.foo.sh@FOO.SH
      group: apache
    - munin-server

  tasks:
    - name: require authentication for munin web
      copy:
        dest: /etc/httpd/conf.local.d/munin-auth.conf
        content: |
          <Location />
            AuthType        GSSAPI
            GssapiBasicAuth On
            AuthName        "Password Required"
            Require         valid-user
          </Location>
        mode: 0644
        owner: root
        group: "{{ ansible_wheel }}"
      notify: restart apache