---
# Playbook for creating access vlans on fabric leaf switches
- name: NXOS fabric
  hosts: n9k:&leaf_fabric
  pre_tasks:
    - name: check vault - fail if not unlocked
      debug: msg="{{ lookup('hashi_vault', 'secret=secret/unlock') }}"
  gather_facts: false

  vars:
    cli:
      username: admin
      password: "{{ lookup('hashi_vault', 'secret=secret/switches/admin') }}"
      host: "{{ inventory_hostname }}"
      transport: cli
    ansible_connection: local

  tasks:
    - name: Ensure VRFs are present
      nxos_vrf:
        provider: "{{ cli }}"
        state: present
        vrf: "{{ item }}"
      with_items:
        "{{ vrf_list }}"

    #########################################
    # later 2 vlans and interfaces should exist
    - name: Ensure all vlans are present
      nxos_vlan:
        provider: "{{ cli }}"
        vlan_id: "{{ item.vlan_id }}"
        state: present
      with_items:
        - "{{ vlan_list }}"

    - name: Ensure all vlan interfaces are present
      nxos_interface:
        provider: "{{ cli }}"
        interface: "{{ item.interface }}"
        admin_state: up
        #this seems to be changed always when setting a descr on a vlan interface
        #description: "{{ item.description|default('') }}"
      with_items:
        - "{{ vlan_list }}"
      when: item.interface is defined

    - name: Ensure all layer 2 interfaces are up
      nxos_interface:
        provider: "{{ cli }}"
        interface: "{{ item.interface }}"
        description: "{{ item.description|default('') }}"
        mode: layer2
        admin_state: up
      with_items:
        - "{{ access_port_list }}"
        - "{{ trunk_port_list }}"
        - "{{ portchannel_list }}"

    #########################################
    # set up vlan interfaces
    - name: Ensure SVI are in the correct VRF
      nxos_vrf_interface:
        provider: "{{ cli }}"
        vrf: "{{ item.vrf }}"
        interface: "{{ item.interface }}"
      with_items:
        - "{{ vlan_list }}"
      when: item.interface is defined

    - name: Set ip addresses on SVI
      nxos_ip_interface:
        provider: "{{ cli }}"
        interface: "{{ item.interface }}"
        addr: "{{ item.address | ipaddr('address') }}"
        mask: "{{ item.address | ipaddr('prefix') }}"
      with_items:
        - "{{ vlan_list }}"
      when: item.interface is defined

    #########################################
    # Set up access ports and trunks
    - name: Set access port vlan
      nxos_switchport:
        provider: "{{ cli }}"
        interface: "{{ item.interface }}"
        mode: access
        access_vlan: "{{ item.vlan }}"
      with_items:
        - "{{ access_port_list }}"
      when: item.vlan is defined

    - name: Set allowed vlans on trunk ports
      nxos_switchport:
        provider: "{{ cli }}"
        interface: "{{ item.interface }}"
        mode: trunk
        trunk_allowed_vlans: "{{ item.vlan_allowed }}"
        native_vlan: "{{ item.native_vlan }}"
      with_items:
        - "{{ trunk_port_list }}"
      when: item.vlan_allowed is defined

    #########################################
    # Set up portchannels
    - name: Enable LACP when portchannels exist
      nxos_feature:
        provider: "{{ cli }}"
        state: enabled
        feature: lacp
      when: portchannel_list

    - name: Add members to portchannels
      nxos_portchannel:
        provider: "{{ cli }}"
        members: "{{ item.members }}"
        group: "{{ item.channel_group }}"
        mode: active
        force: true
      with_items:
        - "{{ portchannel_list }}"

    - name: Set allowed vlans on portchannels
      nxos_switchport:
        provider: "{{ cli }}"
        interface: "{{ item.interface }}"
        mode: trunk
        trunk_allowed_vlans: "{{ item.vlan_allowed }}"
        native_vlan: "{{ item.native_vlan }}"
      with_items:
        - "{{ portchannel_list }}"
      when: item.vlan_allowed is defined

    #########################################
    # spanning tree - port type
    - name: Ensure all ports are STP edge ports unless overridden
      nxos_config:
        provider: "{{ cli }}"
        parents: "interface {{ item.interface }}"
        lines: "{{ 'spanning-tree port type ' +  item.stp_port_type|default('edge') }}"
      with_items:
        - "{{ trunk_port_list }}"
        - "{{ access_port_list }}"
        - "{{ portchannel_list }}"

    #########################################
    # arbitrary extra config lines
    - name: Ensure any extra config options are applied to interfaces
      nxos_config:
        provider: "{{ cli }}"
        lines: "{{ item.extra_lines }}"
        parents: interface {{ item.interface }}
      with_items:
        - "{{ trunk_port_list }}"
        - "{{ access_port_list }}"
        - "{{ portchannel_list }}"
        - "{{ vlan_list }}"
      when: item.extra_lines is defined and item.interface is defined
      tags: extra_lines

    #########################################
    # vrrpv3

    # FIXME - this will check for each vlan, rather than just do it once
    - name: Enable vrrpv3 feature when a vlan uses it
      nxos_feature:
        provider: "{{ cli }}"
        state: enabled
        feature: vrrpv3
      when: item.vrrpv3 is defined
      with_items:
        - "{{ vlan_list }}"
      tags: vrrpv3

    - name: Ensure vrrpv3 is applied for vlans that need it
      nxos_config:
        provider: "{{ cli }}"
        parents: "interface {{ item.interface }}"
        lines:
          - "vrrpv3 {{ item.vrrpv3.group_id|string + ' address-family ' + item.vrrpv3.address_family }}"
      when: item.vrrpv3 is defined
      with_items:
        - "{{ vlan_list }}"
      tags: vrrpv3

    - name: Ensure vrrpv3 options are applied
      nxos_config:
        provider: "{{ cli }}"
        parents:
          - "interface {{ item.interface }}"
          - "vrrpv3 {{ item.vrrpv3.group_id|string + ' address-family ' + item.vrrpv3.address_family }}"
        lines:
          - "description {{ item.vrrpv3.description }}"
          - "address {{ item.vrrpv3.address }} primary"
          - "priority {{ item.vrrpv3.priority }}"       #priority 100 is default, and doesnt show in the running config
      when: item.vrrpv3 is defined
      with_items:
        - "{{ vlan_list }}"
      tags: vrrpv3

    #########################################
    # clobber vlan 1
    - name: Ensure vlan 1 is down
      nxos_interface:
        provider: "{{ cli }}"
        interface: Vlan1
        admin_state: down
        description: 'Vlan1 is not used'

    #########################################
    # clobber vlan 999
    - name: Ensure vlan 999 is down
      nxos_interface:
        provider: "{{ cli }}"
        interface: Vlan999
        admin_state: down
        description: 'Vlan999 should blackhole native vlans'