Funk-lab/ansible/roles/satisfactory_server/tasks/main.yml

---
# --- Dépendances steamcmd (binaire 32 bits) ---

- name: Install steamcmd 32-bit dependencies
  ansible.builtin.dnf:
    name:
      - glibc.i686
      - libstdc++.i686
      - policycoreutils-python-utils   # semanage (contexte SELinux, cf. plus bas)
    state: present

# --- Utilisateur système ---

- name: Create satisfactory system user
  ansible.builtin.user:
    name: "{{ satisfactory_user }}"
    system: true
    shell: /sbin/nologin
    home: "{{ satisfactory_home }}"
    create_home: true
    state: present

- name: Create install directories
  ansible.builtin.file:
    path: "{{ item }}"
    state: directory
    owner: "{{ satisfactory_user }}"
    group: "{{ satisfactory_user }}"
    mode: '0750'
  loop:
    - "{{ satisfactory_steamcmd_dir }}"
    - "{{ satisfactory_install_dir }}"

# --- steamcmd ---

- name: Download steamcmd
  ansible.builtin.get_url:
    url: "https://steamcdn-a.akamaihd.net/client/installer/steamcmd_linux.tar.gz"
    dest: /tmp/steamcmd_linux.tar.gz
    mode: '0644'

- name: Extract steamcmd
  ansible.builtin.unarchive:
    src: /tmp/steamcmd_linux.tar.gz
    dest: "{{ satisfactory_steamcmd_dir }}"
    remote_src: true
    owner: "{{ satisfactory_user }}"
    group: "{{ satisfactory_user }}"
    creates: "{{ satisfactory_steamcmd_dir }}/steamcmd.sh"

# --- Installation initiale du jeu (~10 Go — long au premier run) ---
# Les mises à jour suivantes passent par l'ExecStartPre du service
# (satisfactory_update_on_start), pas par ce task.

# Retries : au tout premier run, steamcmd échoue souvent avec « Missing configuration »
# (rc=8) — l'app info n'est pas encore en cache. Le run suivant passe.
- name: Install Satisfactory dedicated server via steamcmd (first run only)
  ansible.builtin.command:
    cmd: >
      {{ satisfactory_steamcmd_dir }}/steamcmd.sh
      +force_install_dir {{ satisfactory_install_dir }}
      +login anonymous
      +app_update {{ satisfactory_app_id }} validate
      +quit
    creates: "{{ satisfactory_install_dir }}/FactoryServer.sh"
  become: true
  become_user: "{{ satisfactory_user }}"
  environment:
    HOME: "{{ satisfactory_home }}"
  register: satisfactory_steamcmd_install
  retries: 3
  delay: 10
  until: satisfactory_steamcmd_install.rc | default(0) == 0

# --- SELinux ---
# L'unarchive depuis /tmp laisse steamcmd.sh en user_tmp_t et le jeu hérite de var_t
# (/srv) : systemd (init_t) refuse d'exécuter ces types → 203/EXEC Permission denied.
# bin_t sur les deux arborescences exécutables règle le problème.

- name: Set bin_t SELinux context on executable trees
  community.general.sefcontext:
    target: "{{ satisfactory_home }}/(steamcmd|server)(/.*)?"
    setype: bin_t
    state: present
  when: ansible_selinux.status | default('disabled') == 'enabled'

- name: Apply SELinux contexts
  ansible.builtin.command:
    cmd: restorecon -R {{ satisfactory_home }}
  changed_when: false
  when: ansible_selinux.status | default('disabled') == 'enabled'

# --- Service systemd ---

- name: Install satisfactory-server systemd unit
  ansible.builtin.template:
    src: satisfactory-server.service.j2
    dest: /etc/systemd/system/satisfactory-server.service
    mode: '0644'
  notify:
    - Reload systemd
    - Restart satisfactory-server

- name: Enable satisfactory-server service
  ansible.builtin.systemd:
    name: satisfactory-server
    enabled: true
    daemon_reload: true
    state: started

# --- Firewall ---
# 7777 : jeu (UDP) + API HTTPS (TCP). 8888 : reliable messaging (TCP, depuis la 1.1).

- name: Open game ports in firewall
  ansible.posix.firewalld:
    port: "{{ item }}"
    permanent: true
    state: enabled
    immediate: true
  loop:
    - "{{ satisfactory_port }}/tcp"
    - "{{ satisfactory_port }}/udp"
    - "{{ satisfactory_reliable_port }}/tcp"