---
- hosts: localhost
  vars_files:
    - ../vars/common.yml

  tasks:
  - name: Load variables (Standard vs protected)
    include_vars:
      file: ../vars/{{ project_zone }}.yml

  - name: Create security groups
    os_security_group:
      cloud: "{{ os_project }}"
      state: "{{ state }}"
      name: "{{ item }}"
    with_items: "{{ security_groups }}"

  - name: Remove default egress rules (protected only)
    os_security_group:
      cloud: "{{ os_project }}"
      state: "{{ state }}"
      name: "{{ item }}"
      security_group_rules: []
    with_items: "{{ security_groups }}"
    when: project_zone == "protected"

  - name: Set remote group rules for security groups
    os_security_group_rule:
      cloud: "{{ os_project }}"
      state: "{{ state }}"
      description: "{{ rule.comment }}"
      direction: "{{ rule.direction }}"
      security_group: "{{ rule.group }}"
      remote_group: "{{ rule.remote_group }}"
      protocol: "{{ rule.protocol }}"
      port_range_min: "{{ rule.port_min }}"
      port_range_max: "{{ rule.port_max }}"
      ethertype: IPv4
    loop: "{{ remote_group_rules }}"
    loop_control:
      loop_var: rule

  - name: Set remote IP rules for security groups
    os_security_group_rule:
      cloud: "{{ os_project }}"
      state: "{{ state }}"
      description: "{{ rule.comment }}"
      direction: "{{ rule.direction }}"
      security_group: "{{ rule.group }}"
      remote_ip_prefix: "{{ rule.remote_ip }}"
      protocol: "{{ rule.protocol }}"
      port_range_min: "{{ rule.port_min }}"
      port_range_max: "{{ rule.port_max }}"
      ethertype: IPv4
    loop: "{{ remote_ip_rules }}"
    loop_control:
      loop_var: rule

# 1 task to create groups for default egress
# 1 task to create rules that are only for ingress
# maybe use common rules/vars better
# default egress maybe disabled on clients even on standard (add rules)