---
- hosts: localhost
  connection: local
  serial: 1
  gather_facts: no

  tasks:
    - name: Create upcloud server
      upcloud:
        state: present
        hostname: web1.example.com
        title: web1.example.com
        zone: uk-lon1
        plan: 1xCPU-1GB
        storage_devices:
            - { size: 30, os: Ubuntu 14.04 }
            - { size: 100 }
      register: upcloud_server # upcloud_server.server will contain the API response body

    # upcloud_server.public_ip shortcut will contain a public IPv4 (preferred) or IPv6 address
    - name: remove new server from known_hosts in case of IP collision
      known_hosts:
        state: absent
        host: "{{ upcloud_server.public_ip }}"

    # small wait to make sure created server is online (might not be instantly after API response)
    - pause: seconds=5

    # upcloud_server.server.password and upcloud_server.server.username
    # can be used to drop in an SSH key. e.g. with https://gist.github.com/elnygren/965a6db4f3fd8e242e90
    - name: Place ssh key on the server
      shell: >
        ./rsync_ssh_key.sh ~/.ssh/id_rsa.pub
        root@{{upcloud_server.public_ip}}:/root/.ssh/authorized_keys
        {{upcloud_server.server.password}}

    - name: tag the created server
      upcloud_tag:
        state: present
        uuid: "{{ upcloud_server.server.uuid }}"
        tags: [ webservers, london ]

    - name: configure firewall
      upcloud_firewall:
        state: present
        uuid: "{{ upcloud_server.server.uuid }}"
        firewall_rules:
        - direction: in
          family: IPv4
          protocol: udp
          destination_port_start: 53
          destination_port_end: 53
          action: accept

        - direction: in
          family: IPv4
          protocol: tcp
          destination_port_start: 22

          destination_port_end: 22

          action: accept

        - direction: in
          family: IPv4
          protocol: tcp
          destination_port_start: 80
          destination_port_end: 80
          action: accept

        - direction: in
          family: IPv4
          protocol: tcp
          destination_port_start: 443
          destination_port_end: 443
          action: accept

        # default rule last:
        - direction: in
          action: reject