playbook.yml

---
- hosts: loadbalancer
  become: yes
  roles:
    - role: base
    - role: coredns
    - role: traefik
      # NOTE: I'm "abusing" the load balancer VM to collect Vault
      # audit logs just to avoid the need of another VM for this demo.
      #
      # OF COURSE AUDIT LOGS OF YOUR SECRET MANAGEMENT
      # *NEVER* BELONG ON AN OUTSIDE FACING MACHINE!
    - role: syslog-ng
      tags: ['syslog-ng']


- hosts: consul_nomad
  become: yes
  roles:
    - role: base
    - role: consul
    - role: jre
    - role: docker
      tags: ['docker']
    - role: syslog-ng
      tags: ['syslog-ng']
    - role: vault
      tags: ['vault']
    - role: nomad
      tags: ['nomad']

  post_tasks:
    - name: Disable systemd-resolved service
      ansible.builtin.systemd:
        name: systemd-resolved
        state: stopped
        enabled: no
      tags: ['always']

    - name: Set nameserver to localhost
      ansible.builtin.copy:
        content: "nameserver {{ loadbalancer_ip }}"
        dest: /etc/resolv.conf
        mode: 0644
      tags: ['always']

    - name: Restart Docker to pick up DNS change
      ansible.builtin.systemd:
        name: docker
        state: restarted
      tags: ['docker']