# SPDX-License-Identifier: MIT
---
- name: Ensure that tls encryption configuration works
  hosts: all
  vars:
    mssql_accept_microsoft_odbc_driver_17_for_sql_server_eula: true
    mssql_accept_microsoft_cli_utilities_for_sql_server_eula: true
    mssql_accept_microsoft_sql_server_standard_eula: true
    mssql_password: "p@55w0rD"
    mssql_edition: Evaluation
    mssql_tcp_port: 1433
    mssql_version: 2019
  tasks:
    - name: Ensure the openssl package
      package:
        name: openssl
        state: present
      run_once: true

    - name: Create a tempfile for a certificate on hosts
      tempfile:
        state: file
      register: __mssql_cert_tempfile
      run_once: true

    - name: Create a tempfile for a private key on hosts
      tempfile:
        state: file
      register: __mssql_pvk_tempfile
      run_once: true

    - name: Generate a self-signed certificate and public key
      command: >-
        openssl req -x509 -nodes -newkey rsa:2048
        -subj "/CN={{ ansible_default_ipv4.address }}"
        -out {{ __mssql_cert_tempfile.path }}
        -keyout {{ __mssql_pvk_tempfile.path }} -days 365
      changed_when: true
      run_once: true

    - name: Copy certificate files to local tmp
      fetch:
        src: "{{ item }}"
        dest: "{{ item }}"
        flat: true
        mode: preserve
      run_once: true
      loop:
        - "{{ __mssql_cert_tempfile.path }}"
        - "{{ __mssql_pvk_tempfile.path }}"

  # Test relative and full path with mssql_tls_remote_src: false
    - name: Copy a private key to the playbook directory to test a relative path
      copy:
        src: "{{ __mssql_pvk_tempfile.path }}"
        dest: "{{ __mssql_pvk_tempfile.path | basename }}"
        mode: preserve
      delegate_to: localhost
      run_once: true

    - name: Test relative and full path with certs on control node
      block:
        - name: Run role
          include_role:
            name: microsoft.sql.server
            public: true
          vars:
            mssql_tls_enable: true
            mssql_tls_cert: "{{ __mssql_cert_tempfile.path }}"
            mssql_tls_private_key: "{{ __mssql_pvk_tempfile.path | basename }}"
      always:
        - name: Remove a private key from the playbook directory
          file:
            path: "{{ __mssql_pvk_tempfile.path | basename }}"
            state: absent
          delegate_to: localhost
          run_once: true

    - name: Configure the mssql-server service start limit interval and burst
      include_tasks: tasks/mssql-sever-increase-start-limit.yml

    - name: Verify connectivity and settings
      include_tasks: tasks/verify_settings.yml
      vars:
        __verify_mssql_password: "p@55w0rD"
        __verify_mssql_is_tls_encrypted: true

  # Test disabling TLS encryption
    - name: Disable TLS encryption
      include_role:
        name: microsoft.sql.server
        public: true
      vars:
        mssql_tls_enable: false

    - name: Verify connectivity and settings
      include_tasks: tasks/verify_settings.yml
      vars:
        __verify_mssql_password: "p@55w0rD"
        __verify_mssql_is_tls_encrypted: false

  # Test mssql_tls_remote_src: true
    - name: Remove certificates from hosts
      file:
        path: "{{ item }}"
        state: absent
      loop:
        - /etc/pki/tls/certs/{{ __mssql_cert_tempfile.path | basename }}
        - /etc/pki/tls/private/{{ __mssql_pvk_tempfile.path | basename }}

    - name: Copy certificates to hosts
      copy:
        src: "{{ item }}"
        dest: "{{ item }}"
        mode: preserve
      loop:
        - "{{ __mssql_cert_tempfile.path }}"
        - "{{ __mssql_pvk_tempfile.path }}"

    - name: Test with certs on managed nodes
      include_role:
        name: microsoft.sql.server
        public: true
      vars:
        mssql_tls_enable: true
        mssql_tls_cert: "{{ __mssql_cert_tempfile.path }}"
        mssql_tls_private_key: "{{ __mssql_pvk_tempfile.path }}"
        mssql_tls_remote_src: true

    - name: Verify connectivity and settings
      include_tasks: tasks/verify_settings.yml
      vars:
        __verify_mssql_password: "p@55w0rD"
        __verify_mssql_is_tls_encrypted: true

    - name: Check the ansible_managed header in the configuration file
      include_tasks: tasks/check_header.yml

  # Test disabling TLS encryption
    - name: Disable TLS encryption
      include_role:
        name: microsoft.sql.server
      vars:
        mssql_tls_enable: false

    - name: Verify connectivity and settings
      include_tasks: tasks/verify_settings.yml
      vars:
        __verify_mssql_password: "p@55w0rD"
        __verify_mssql_is_tls_encrypted: false

  # Test mssql_tls_certificates
    - name: Test with certs created by the certificate role
      include_role:
        name: microsoft.sql.server
        public: true
      vars:
        mssql_tls_enable: true
        mssql_tls_certificates:
          - name: mssql_2019_cert
            common_name: "{{ ansible_default_ipv4.address }}"
            ca: self-sign

    - name: Flush handlers
      meta: flush_handlers

    - name: Verify connectivity and settings
      include_tasks: tasks/verify_settings.yml
      vars:
        __verify_mssql_password: "p@55w0rD"
        __verify_mssql_is_tls_encrypted: true
