From 7955e5e001acaf032e99e34f83a9a0f64ef9f06d Mon Sep 17 00:00:00 2001
From: Daniel Allaire <allaire.dan@chezlepro.ca>
Date: Sun, 8 Feb 2026 21:41:17 -0500
Subject: [PATCH] Activation de Greenlight

---
 Makefile                                         | 11 ++++++++++-
 README.md                                        | 15 +++++++++++++++
 group_vars/all.yml                               |  2 +-
 roles/bbb_install/tasks/main.yml                 | 12 +++++++++++-
 roles/bbb_vps_prep/files/apply-hostfilter-nft.sh |  0
 5 files changed, 37 insertions(+), 3 deletions(-)
 mode change 100755 => 100644 roles/bbb_vps_prep/files/apply-hostfilter-nft.sh

diff --git a/Makefile b/Makefile
index 4c864ea..ea92227 100644
--- a/Makefile
+++ b/Makefile
@@ -5,7 +5,7 @@ PLAYBOOK  ?= site.yml
 EXTRA_VARS ?=
 ANSIBLE   ?= ansible-playbook
 
-.PHONY: help ping check run dry-run diff vars tree clean prep bbb bbb-dry-run
+.PHONY: help ping check run dry-run diff vars tree clean prep bbb bbb-dry-run greenlight greenlight-dry-run
 
 help:
 	@echo "Targets:"
@@ -20,6 +20,8 @@ help:
 	@echo "Examples:"
 	@echo "  make run EXTRA_VARS='-e ssh_allow_cidrs_v4=[\"1.2.3.4/32\"]'"
 	@echo "  make vars host=bbb"
+	@echo "  make greenlight - installer/mettre à niveau Greenlight v3 (bbb-install -g)"
+	@echo "  make greenlight-dry-run - check mode pour Greenlight"
 
 ping:
 	ansible -i $(INVENTORY) vps -m ping
@@ -54,3 +56,10 @@ bbb:
 
 bbb-dry-run:
 	$(ANSIBLE) -i $(INVENTORY) $(PLAYBOOK) --become --tags bbb --check --diff $(EXTRA_VARS)
+
+
+greenlight:
+	$(ANSIBLE) -i $(INVENTORY) $(PLAYBOOK) --become --tags bbb $(EXTRA_VARS) -e bbb_install_greenlight=true
+
+greenlight-dry-run:
+	$(ANSIBLE) -i $(INVENTORY) $(PLAYBOOK) --become --tags bbb --check --diff $(EXTRA_VARS) -e bbb_install_greenlight=true
diff --git a/README.md b/README.md
index 50c35f6..b500003 100644
--- a/README.md
+++ b/README.md
@@ -52,3 +52,18 @@ make bbb-dry-run
 ```
 
 > Note: BBB 3.x installe un TURN local + HAProxy pour partager le port 443 avec HTTPS. Le firewall `hostfilter` doit donc autoriser **UDP/443** en plus de TCP/443.
+
+
+## Greenlight v3 (portail principal)
+
+Installation sur le domaine racine (remplace la page d’accueil BBB) :
+
+```bash
+make greenlight
+```
+
+Créer un compte admin :
+
+```bash
+sudo docker exec -it greenlight-v3 bundle exec rake admin:create
+```
diff --git a/group_vars/all.yml b/group_vars/all.yml
index 0a7cf7b..8195f36 100644
--- a/group_vars/all.yml
+++ b/group_vars/all.yml
@@ -53,4 +53,4 @@ bbb_install_enabled: true
 bbb_version: "jammy-300"          # installe toujours la dernière 3.0.x
 letsencrypt_email: "allaire.dan@chezlepro.ca"             # OBLIGATOIRE: email pour Let's Encrypt (ex: ops@chezlepro.ca)
 bbb_skip_min_requirements: true    # -j: utile si IPv6 désactivé ou serveur < recommandations prod
-bbb_install_greenlight: false      # -g (optionnel)
+bbb_install_greenlight: true      # -g (optionnel)
diff --git a/roles/bbb_install/tasks/main.yml b/roles/bbb_install/tasks/main.yml
index b050338..3298e7f 100644
--- a/roles/bbb_install/tasks/main.yml
+++ b/roles/bbb_install/tasks/main.yml
@@ -42,6 +42,16 @@
     path: /usr/bin/bbb-conf
   register: bbb_conf_bin
 
+- name: Detect if Greenlight v3 is already installed (docker container)
+  ansible.builtin.command: "docker ps -a --format '{{ '{{.Names}}' }}'"
+  register: docker_ps_names
+  changed_when: false
+  failed_when: false
+
+- name: Set fact greenlight_installed
+  ansible.builtin.set_fact:
+    greenlight_installed: "{{ 'greenlight-v3' in (docker_ps_names.stdout_lines | default([])) }}"
+
 - name: Run bbb-install.sh (BBB 3.x + built-in TURN/haproxy)
   ansible.builtin.command: >
     {{ bbb_install_script_path }}
@@ -52,7 +62,7 @@
     {% if bbb_install_greenlight | bool %}-g{% endif %}
   register: bbb_install_run
   changed_when: true
-  when: bbb_install_force | bool or not bbb_conf_bin.stat.exists
+  when: bbb_install_force | bool or (not bbb_conf_bin.stat.exists) or (bbb_install_greenlight | bool and not (greenlight_installed | default(false) | bool))
 
 # --- Post-install: align coturn relay UDP range with our nftables policy ---
 - name: Ensure /etc/turnserver.conf exists (installed by bbb-install)
diff --git a/roles/bbb_vps_prep/files/apply-hostfilter-nft.sh b/roles/bbb_vps_prep/files/apply-hostfilter-nft.sh
old mode 100755
new mode 100644