---
- name: Test with generated self-signed certmonger certificate
  hosts: all
# certmonger does not work in container builds
  tags:
    - tests::booted
  tasks:
    - name: Tests
      block:
        - name: Include role
          include_role:
            name: fedora.linux_system_roles.cockpit
            public: true
          vars:
            cockpit_packages: minimal

        - name: Collect installed package versions
          package_facts:

        - name: Check if cockpit is new enough (at least 211) to support certmonger
          when: ansible_facts.packages['cockpit-ws'][0].version | int >= 211
          block:
          # Fixed in cockpit 255 (https://github.com/cockpit-project/cockpit/commit/6ec4881856e)
            - name: >-
                Allow certmonger to write into Cockpit's certificate directory
              file:
                path: /etc/cockpit/ws-certs.d/
                state: directory
                setype: cert_t
                mode: "0755"

          # returns global variable __cockpit_test_group
            - name: Get name of cockpit group to use
              include_tasks: tasks/get_cockpit_group.yml

          # has to be done dynamically, as the first step checks it out
            - name: Generate certificate with certificate system role
              include_role:
                name: fedora.linux_system_roles.certificate
              vars:
                certificate_requests:
                  - name: /etc/cockpit/ws-certs.d/monger-cockpit
                    dns: ['localhost', 'www.example.com']
                    ca: self-sign
                    group: "{{ __cockpit_test_group }}"

          # ostree cannot remove packages and cannot cleanup properly
          # this works around that issue
            - name: Restart cockpit to use the new certificates
              service:
                name: "{{ __cockpit_daemon }}"
                state: restarted
              when: __cockpit_is_ostree | d(false)

          #
          # Validate installation
          #

            - name: Test - cockpit works with TLS and expected certificate
            # noqa command-instead-of-module
              command:
                cmd: >
                  curl --cacert /etc/cockpit/ws-certs.d/monger-cockpit.crt
                  https://localhost:9090
              # ansible 2.11's uri module has ca_path,
              # but that's still too new for us
              changed_when: false

            - name: Test - get certmonger tracking status
              command: >
                getcert list  --tracking-only
                -f /etc/cockpit/ws-certs.d/monger-cockpit.crt
              register: result
              changed_when: false

            - name: Test - ensure certificate generation succeeded
              assert:
                that: "'status: MONITORING' in result.stdout"

            - name: Test - clean up tracked certificate
              command: >
                getcert stop-tracking
                -f /etc/cockpit/ws-certs.d/monger-cockpit.crt
              changed_when: false

      always:
        - name: Test - clean up generated certificate
          file:
            path: /etc/cockpit/ws-certs.d/monger-cockpit.crt
            state: absent

        - name: Test - clean up generated private key
          file:
            path: /etc/cockpit/ws-certs.d/monger-cockpit.key
            state: absent

        - name: Test - generic cleanup
          include_tasks: tasks/cleanup.yml
