---
- name: Test the cockpit role calling the certificate role internally
  hosts: all
# certmonger does not work in container builds
  tags:
    - tests::booted
  tasks:
    - name: Tests
      vars:
        cert_name: cockpit_cert
      block:
        - name: >-
            Install cockpit using the certificate role to create a certificate
          block:
          # install cockpit package to get group
            - name: Include role
              include_role:
                name: fedora.linux_system_roles.cockpit
                public: true
              vars:
                cockpit_packages: minimal

          # returns global variable __cockpit_test_group
            - name: Get name of cockpit group to use
              include_tasks: tasks/get_cockpit_group.yml

            - name: Install cockpit with cockpit_certificates request
              vars:
                cockpit_packages: minimal
                cockpit_certificates:
                  - name: "{{ cert_name }}"
                    dns: ['localhost', 'www.example.com']
                    ca: self-sign
                    group: "{{ __cockpit_test_group }}"
              include_role:
                name: fedora.linux_system_roles.cockpit
                public: true
          rescue:
            - name: Check the error message
              vars:
                expected: >-
                  Creating a self-signed certificate is not supported on
                  {{ ansible_facts['distribution'] }}-{{
                     ansible_facts['distribution_version'] }}
              assert:
                that: ansible_failed_result.msg == expected
              when:
                - ansible_facts['os_family'] == 'RedHat'
                - ansible_facts['distribution_version'] | int == 7

        - name: >-
            Verify self-signed certmonger certificate created by the
            certificate role
          when:
            - ansible_facts['os_family'] == 'RedHat'
            - ansible_facts['distribution_version'] | int > 7
          block:
            - name: Collect installed package versions
              package_facts:

          # ostree cannot remove packages and cannot cleanup properly
          # this works around that issue
            - name: Restart cockpit to use the new certificates
              service:
                name: "{{ __cockpit_daemon }}"
                state: restarted
              when: __cockpit_is_ostree | d(false)

          # Validate installation
            - name: Test - cockpit works with TLS and expected certificate
            # noqa command-instead-of-module
              command:
                cmd: >
                  curl --cacert "/etc/pki/tls/certs/{{ cert_name }}.crt"
                  https://localhost:9090
              # ansible 2.11's uri module has ca_path,
              # but that's still too new for us
              changed_when: false

            - name: Test - get certmonger tracking status
              command: >
                getcert list  --tracking-only
                -f "/etc/pki/tls/certs/{{ cert_name }}.crt"
              register: result
              changed_when: false

            - name: Test - ensure certificate generation succeeded
              assert:
                that: "'status: MONITORING' in result.stdout"

            - name: Test - clean up tracked certificate
              command: >
                getcert stop-tracking
                -f "/etc/pki/tls/certs/{{ cert_name }}.crt"
              changed_when: false

      always:
        - name: Test - clean up generated certificate
          file:
            path: "/etc/pki/tls/certs/{{ cert_name }}.crt"
            state: absent

        - name: Test - clean up generated private key
          file:
            path: "/etc/pki/tls/private/{{ cert_name }}.key"
            state: absent

        - name: Test - generic cleanup
          include_tasks: tasks/cleanup.yml
