Ansible for Advanced Nuclear and SMR Infrastructure — Deploy Monitoring and Safety Systems

---
- name: Deploy radiation monitoring infrastructure
  hosts: radiation_monitors
  become: true
  vars:
    monitoring_interval_sec: 10
    alert_threshold_usv: 20

  tasks:
    - name: Install monitoring software
      ansible.builtin.package:
        name:
          - radiation-monitor-agent
          - prometheus-node-exporter
        state: present

    - name: Configure radiation monitor
      ansible.builtin.template:
        src: rad-monitor.conf.j2
        dest: /etc/radiation-monitor/config.yml
      notify: Restart radiation monitor

    - name: Deploy alert thresholds
      ansible.builtin.template:
        src: rad-thresholds.yml.j2
        dest: /etc/radiation-monitor/thresholds.yml

    - name: Configure data retention (regulatory requirement)
      ansible.builtin.lineinfile:
        path: /etc/radiation-monitor/config.yml
        line: "retention_years: 75"

    - name: Start monitoring service
      ansible.builtin.service:
        name: radiation-monitor
        state: started
        enabled: true

    - name: Verify data collection
      ansible.builtin.uri:
        url: http://localhost:9100/metrics
      register: metrics
      until: "'radiation_dose_rate' in metrics.content"
      retries: 10
      delay: 5

  handlers:
    - name: Restart radiation monitor
      ansible.builtin.service:
        name: radiation-monitor
        state: restarted

- name: Harden nuclear SCADA systems
  hosts: scada_systems
  become: true
  tasks:
    - name: Enforce network segmentation (NEI 08-09)
      ansible.builtin.iptables:
        chain: INPUT
        source: "{{ item }}"
        jump: DROP
        comment: "Block non-OT network access"
      loop: "{{ blocked_networks }}"

    - name: Allow only approved OT protocols
      ansible.builtin.iptables:
        chain: INPUT
        protocol: tcp
        destination_port: "{{ item.port }}"
        source: "{{ ot_network }}"
        jump: ACCEPT
        comment: "Allow {{ item.name }}"
      loop:
        - { port: 502, name: "Modbus TCP" }
        - { port: 4840, name: "OPC-UA" }
        - { port: 20000, name: "DNP3" }

    - name: Disable unnecessary services
      ansible.builtin.service:
        name: "{{ item }}"
        state: stopped
        enabled: false
      loop:
        - bluetooth
        - cups
        - avahi-daemon
        - nfs-server
      ignore_errors: true

    - name: Enforce USB device restrictions
      ansible.builtin.copy:
        content: |
          # Block all USB storage devices
          blacklist usb-storage
          blacklist uas
        dest: /etc/modprobe.d/usb-storage-block.conf

    - name: Configure audit logging (NRC requirement)
      ansible.builtin.template:
        src: nuclear-audit.rules.j2
        dest: /etc/audit/rules.d/nuclear.rules
      notify: Restart auditd

    - name: Deploy integrity monitoring
      ansible.builtin.template:
        src: aide-nuclear.conf.j2
        dest: /etc/aide/aide.conf
      notify: Initialize AIDE

  handlers:
    - name: Restart auditd
      ansible.builtin.service:
        name: auditd
        state: restarted
    - name: Initialize AIDE
      ansible.builtin.command: aide --init

- name: Deploy plant information system
  hosts: plant_info_servers
  become: true
  tasks:
    - name: Deploy time-series database
      community.docker.docker_container:
        name: plant-tsdb
        image: timescale/timescaledb-ha:pg16
        state: started
        restart_policy: unless-stopped
        ports: ["5432:5432"]
        volumes:
          - /data/plant-tsdb:/var/lib/postgresql/data
        env:
          POSTGRES_PASSWORD: "{{ vault_db_password }}"
        shm_size: 4G
      no_log: true

    - name: Deploy data historian
      community.docker.docker_container:
        name: plant-historian
        image: "{{ historian_image }}"
        state: started
        ports: ["8080:8080"]
        env:
          DB_URL: "postgresql://plant:{{ vault_db_password }}@localhost:5432/plant_data"
          RETENTION_YEARS: "75"
          SAMPLING_RATE_MS: "100"

    - name: Deploy plant dashboard
      community.docker.docker_container:
        name: plant-grafana
        image: grafana/grafana:latest
        state: started
        ports: ["3000:3000"]
        volumes:
          - /opt/grafana/dashboards:/var/lib/grafana/dashboards

- name: NRC compliance reporting
  hosts: compliance_servers
  become: true
  tasks:
    - name: Generate daily radiation report
      ansible.builtin.cron:
        name: "NRC daily radiation report"
        hour: "23"
        minute: "55"
        job: >
          /opt/compliance/generate-report.py
          --type daily_radiation
          --format nrc-reg-guide-8.34
          --output /data/reports/rad-$(date +%Y%m%d).pdf
          >> /var/log/compliance.log 2>&1

    - name: Generate quarterly environmental report
      ansible.builtin.cron:
        name: "NRC quarterly environmental"
        month: "1,4,7,10"
        day: "1"
        hour: "6"
        job: >
          /opt/compliance/generate-report.py
          --type quarterly_environmental
          --format nrc-reg-guide-4.15
          --output /data/reports/env-q$(date +%q-%Y).pdf

    - name: Verify report retention
      ansible.builtin.find:
        paths: /data/reports
        age: "-1d"
        patterns: "*.pdf"
      register: recent_reports

    - name: Alert if daily report missing
      ansible.builtin.debug:
        msg: "⚠️ No compliance report generated in last 24h"
      when: recent_reports.files | length == 0

    - name: Backup reports to offsite storage
      ansible.builtin.cron:
        name: "Offsite report backup"
        hour: "2"
        minute: "0"
        job: >
          rsync -az /data/reports/
          {{ offsite_backup_host }}:/backup/nuclear-reports/
          >> /var/log/report-backup.log 2>&1

- name: Configure emergency notification system
  hosts: safety_servers
  become: true
  tasks:
    - name: Deploy emergency notification service
      ansible.builtin.template:
        src: emergency-notify.conf.j2
        dest: /etc/emergency-notify/config.yml
      notify: Restart emergency service

    - name: Test emergency communication channels
      ansible.builtin.uri:
        url: "http://localhost:8090/api/test"
        method: POST
        body_format: json
        body:
          test: true
          channels: [siren, pager, sms, email]
      register: test_result

    - name: Verify all channels operational
      ansible.builtin.assert:
        that:
          - test_result.json.all_channels_ok == true
        fail_msg: "Emergency channels NOT fully operational!"

    - name: Schedule weekly emergency system test
      ansible.builtin.cron:
        name: "Weekly emergency system test"
        weekday: "1"
        hour: "10"
        minute: "0"
        job: "/opt/safety/test-emergency-systems.sh >> /var/log/emergency-test.log 2>&1"