roles:
    - common
    - { role: "ec2" }
    - { role: "apache" }
    - { role: "vhost-wordpress",
        vhost_name: "site01" }
    - { role: "vhost-wordpress",
        vhost_name: "site02" }
    - { role: "vhost-wordpress",
        vhost_name: "site03" }

host1
host2

vhosts:
    site1.hoge.com:
        param1: huga
    site2.hoge.com:
        param1: huga

vhosts:
    site10.hoge.com:
        param1: huga
    site11.hoge.com:
        param1: huga

---
- hosts: webservers
  become: yes
  become_user: root
  roles:
    - ec2
    - common
    - apache
  tasks:
    - include_vars: vars/defaults.yml
    - name: setup vhost
      include_tasks: tasks/deploy_wp_vhost.yml
        HOST="{{ inventory_hostname }}"
        HOSTNAME="{{ item.key.split('.')[0] }}"
        VHOSTNAME="{{ item.key }}"
        MANAGE_PASSWORD="{{  item.value.manage_password }}"
      with_dict: "{{ hostvars[inventory_hostname].vhosts }}"

- name: route53 update
  route53:
    aws_access_key: "{{ lookup('env', 'AWS_ACCESS_KEY_ID') }}"
    aws_secret_key: "{{ lookup('env', 'AWS_SECRET_ACCESS_KEY') }}"
    state: present
    overwrite: yes
    zone: "{{ R53_ZONE }}"
    record: "{{ VHOSTNAME }}"
    type: A
    ttl: 300
    value: "{{ HOST }}"
  delegate_to: localhost
  become: false
  register: r53_status

- name: S3バケットを作成しています。 "{{ bucket_name }}"
  s3_bucket:
    name: "{{ bucket_name }}"
    policy: "{{ lookup('template','public.json.j2') }}"
    state: present
    region: ap-northeast-1
    aws_access_key: "{{ lookup('env', 'AWS_ACCESS_KEY_ID') }}"
    aws_secret_key: "{{ lookup('env', 'AWS_SECRET_ACCESS_KEY') }}"
  delegate_to: localhost
  become: false
  register: s3_status

{
  "Version":"2012-10-17",
  "Statement":[{
    "Sid":"PublicReadGetObject",
        "Effect":"Allow",
      "Principal": "*",
      "Action":["s3:GetObject"],
      "Resource":["arn:aws:s3:::{{ bucket_name }}/*"
      ]
    }
  ]
}

- name: S3バケットに対応したIAMを作成しクレデンシャル取得
  iam:
    iam_type: user
    name: "{{ VHOSTNAME }}"
    key_count: 1
    access_key_state: create
    state: present
    groups: "{{ IAM_GROUP }}"
  delegate_to: localhost
  become: false
  register: credentials

- name: iamのpolicy設定
  iam_policy:
    iam_type: user
    iam_name: "{{ VHOSTNAME }}"
    policy_name: "s3_limited_access_{{ bucket_name }}"
    policy_json: "{{ lookup( 'template', 's3_policy.json.j2') }}"
    state: present
  delegate_to: localhost
  become: false
  when: credentials.changed

- name: access_keyを保存
  set_fact:
    s3_access_key: "{{ credentials['user_meta']['access_keys'][0]['access_key_id'] }}"
  when: credentials['user_meta']['access_keys'][0]['access_key_id'] is defined

- name: s3_secret_access_keyを保存
  set_fact:
    s3_secret_access_key: "{{ credentials['user_meta']['access_keys'][0]['secret_access_key'] }}"
  when: credentials['user_meta']['access_keys'][0]['secret_access_key'] is defined

- name: copy wordpres config
  become: true
  template:
    src: wp-config-sample.php
    dest: "{{ wp_vhost_path }}/wp-config.php"
    owner: apache
    group: apache
    mode: 0755
  when: s3_secret_access_key is defined

define('DBI_AWS_ACCESS_KEY_ID', '{{ s3_access_key }}');
define('DBI_AWS_SECRET_ACCESS_KEY', '{{ s3_secret_access_key }}');
define('AS3CF_BUCKET', '{{ bucket_name }}');
define('AS3CF_REGION', 'ap-northeast-1');

- name: install wp-cli
  become: true
  get_url: url=https://raw.githubusercontent.com/wp-cli/builds/gh-pages/phar/wp-cli.phar
    dest="/usr/local/bin/" validate_certs=no mode=0755

- name: instlal plugin
  become: yes
  become_user: apache
  shell: "/usr/local/bin/wp-cli.phar --path={{ wp_vhost_path }} plugin install {{ plugin }}"
  with_items:
    - "amazon-web-services"
    - "amazon-s3-and-cloudfront"
  loop_control:
      loop_var: plugin
  when: db_created.changed

- name: activate plugin
  become: yes
  become_user: apache
  shell: "/usr/local/bin/wp-cli.phar --path={{ wp_vhost_path }} plugin activate {{ plugin }}"
  with_items:
    - "amazon-web-services"
    - "amazon-s3-and-cloudfront"
  loop_control:
      loop_var: plugin
  when: db_created.changed

- name: config plugin
  become: yes
  become_user: apache
  shell: "/usr/local/bin/wp-cli.phar --path={{ wp_vhost_path }} option update tantan_wordpress_s3 '{{ lookup('template', 'tantan_wordpress_s3_option.json') }}' --format=json"
  when: db_created.changed

{
  "post_meta_version": 6,
  "region": "",
  "domain": "path",
  "cloudfront": "",
  "object-prefix": "wp-content\/uploads\/",
  "copy-to-s3": "1",
  "serve-from-s3": "0",
  "remove-local-file": "0",
  "force-https": "0",
  "object-versioning": "1",
  "use-yearmonth-folders": "1",
  "enable-object-prefix": "1"
}