---
- name: Test cockpit_* role options
  hosts: all
  gather_facts: true
# role vars, but we also check them in tasks/check_port.yml
  vars:
    cockpit_manage_firewall: true
    cockpit_manage_selinux: true
    cockpit_port: 443
  tasks:
    - name: Tests
      block:
        - name: Run cockpit role
          include_role:
            name: fedora.linux_system_roles.cockpit
            public: true
          vars:
            cockpit_packages: minimal

        - name: Flush handlers
          meta: flush_handlers

      # config file only check for non-booted environments
        - name: Test - Ensure that port was configured
          command: grep -q ListenStream=443 /etc/systemd/system/cockpit.socket.d/listen.conf
          changed_when: false

        - name: Test - cockpit works on customized port
          get_url:
            dest: /run/out
            url: https://localhost
            validate_certs: false
            mode: "0600"
          when: __cockpit_is_booted

        - name: Test - HTTP response is something sensible
          command: grep 'id="login-user-input"' /run/out
          changed_when: false
          when: __cockpit_is_booted

        - name: Test - cockpit does not listen on port 9090
          get_url:
            dest: /run/out
            url: https://localhost:9090
            validate_certs: false
            mode: "0600"
          register: result
          failed_when: result is succeeded
          when: __cockpit_is_booted

        - name: Test - ensure cockpit_port is configured for firewall
          include_tasks: tasks/check_port.yml

        - name: Test - clean up output file
          file:
            path: /run/out
            state: absent

      always:
        - name: Cleanup
          include_tasks: tasks/cleanup.yml
