---
- name: Ensure UID and GID exists
  hosts: all
  tasks:
    - name: Ensure user exists
      user:
        name: user1
        uid: 1040
      when: not __bootc_validation | d(false)

    - name: Ensure group "somegroup" exists
      group:
        name: somegroup
        gid: 1041
      when: not __bootc_validation | d(false)

    - name: Issue certificate setting user/group
      include_role:
        name: fedora.linux_system_roles.certificate
      vars:
        certificate_requests:
          - name: mycert_fs_attrs
            dns: www.example.com
            owner: ftp
            group: ftp
            ca: self-sign
          - name: certid
            dns: www.example.com
            owner: 1040
            group: 1041
            ca: self-sign
      when: not __bootc_validation | d(false)

    - name: Verify each user/group certificate
      include_tasks: tasks/assert_certificate_parameters.yml
      loop: "{{ certificates }}"
      loop_control:
        loop_var: cert
      vars:
        certificates:
          - path: /etc/pki/tls/certs/mycert_fs_attrs.crt
            key_path: /etc/pki/tls/private/mycert_fs_attrs.key
            subject:
              - name: commonName
                oid: 2.5.4.3
                value: www.example.com
            subject_alt_name:
              - name: DNS
                value: www.example.com
            owner: ftp
            group: ftp
            mode: "0640"
          - path: /etc/pki/tls/certs/certid.crt
            key_path: /etc/pki/tls/private/certid.key
            subject:
              - name: commonName
                oid: 2.5.4.3
                value: www.example.com
            subject_alt_name:
              - name: DNS
                value: www.example.com
            owner: 1040
            group: 1041
            mode: "0640"

    - name: Issue certificate setting user/group/mode
      include_role:
        name: fedora.linux_system_roles.certificate
      vars:
        certificate_requests:
          - name: mycert_fs_attrs_mode
            dns: www.example.com
            owner: ftp
            group: ftp
            mode: "0620"
            ca: self-sign
          - name: certid_mode
            dns: www.example.com
          # octal numeric value is supported too
          # yamllint disable rule:octal-values
            mode: 0o600
            ca: self-sign
      when: not __bootc_validation | d(false)

    - name: Create QEMU deployment during bootc end-to-end test
      delegate_to: localhost
      become: false
      command: "{{ lsr_scriptdir }}/bootc-buildah-qcow.sh {{ ansible_host }}"
      changed_when: true
      when: ansible_connection == "buildah"

    - name: Verify each fs_attrs_mode certificate
      include_tasks: tasks/assert_certificate_parameters.yml
      loop: "{{ certificates }}"
      loop_control:
        loop_var: cert
      vars:
        certificates:
          - path: /etc/pki/tls/certs/mycert_fs_attrs_mode.crt
            key_path: /etc/pki/tls/private/mycert_fs_attrs_mode.key
            subject:
              - name: commonName
                oid: 2.5.4.3
                value: www.example.com
            subject_alt_name:
              - name: DNS
                value: www.example.com
            owner: ftp
            group: ftp
            mode: "0620"
          - path: /etc/pki/tls/certs/certid_mode.crt
            key_path: /etc/pki/tls/private/certid_mode.key
            subject:
              - name: commonName
                oid: 2.5.4.3
                value: www.example.com
            subject_alt_name:
              - name: DNS
                value: www.example.com
            mode: "0600"
