---
# This approach uses a `run_after:` shell script. This works everywhere,
# including RHEL/CentOS 7, but is hackish and non-obvious in `getcert list`.
# tests_certificate.yml covers a cleaner approach.
# yamllint disable rule:line-length
- name: Test certificate issuance with run_after shell script
  hosts: all
  tasks:
    - name: Install cockpit
      vars:
        cockpit_packages: minimal
      include_role:
        name: redhat.rhel_system_roles.cockpit

  # self-signed is broken (https://github.com/linux-system-roles/certificate/issues/98),
  # and has too restrictive keyUsage so that using the certificate as CA is not allowed
  # (https://github.com/linux-system-roles/certificate/issues/99), thus use "local"
  # Fixed in cockpit 255 (https://github.com/cockpit-project/cockpit/commit/6ec4881856e)
    - name: Allow certmonger to write into Cockpit's certificate directory
      file:
        path: /etc/cockpit/ws-certs.d/
        state: directory
        setype: cert_t
        mode: 0755

  # has to be done dynamically, as the first step checks it out
    - name: Generate certificate with certificate system role
      include_role:
        name: redhat.rhel_system_roles.certificate
        public: true
      vars:
        certificate_requests:
          - name: monger-cockpit
            dns: ['localhost', 'www.example.com']
            ca: local
            group: cockpit-ws
          # ideally we'd put the cert directly into /etc/cockpit/ws-certs.d;
          # however, cockpit in RHEL/CentOS 7 does not yet support a separate
          # key file, and lsr.certificate sets wrong permissions
          # (https://github.com/linux-system-roles/certificate/pull/97)
            run_after: |
              DEST=/etc/cockpit/ws-certs.d/monger-cockpit.cert
              cat {{ __certificate_default_directory }}/certs/monger-cockpit.crt \
              {{ __certificate_default_directory }}/private/monger-cockpit.key > $DEST
              chmod 640 $DEST
              chown root:cockpit-ws $DEST

    - name: Validate installation
      block:
      # ugh, is there really no better way to do that?
        - name: Get PEM of certmonger's local CA
          command:
            cmd: >
              openssl pkcs12 -in /var/lib/certmonger/local/creds
              -out /var/lib/certmonger/local/ca.pem
              -nokeys -nodes -passin pass:""
            creates: /var/lib/certmonger/local/ca.pem

        - name: Test - cockpit works with TLS and expected certificate
        # noqa command-instead-of-module
          command:
            cmd: >
              curl --cacert /var/lib/certmonger/local/ca.pem
              https://localhost:9090
          # ansible 2.11's uri module has ca_path,
          # but that's still too new for us
          changed_when: false

        - name: Test - get certmonger tracking status
          command: >
            getcert list  --tracking-only -f
            {{ __certificate_default_directory }}/certs/monger-cockpit.crt
          register: result
          changed_when: false

        - name: Test - ensure certificate generation succeeded
          assert:
            that: "'status: MONITORING' in result.stdout"

        - name: Test - clean up tracked certificate
          command: >
            getcert stop-tracking -f
            {{ __certificate_default_directory }}/certs/monger-cockpit.crt
          changed_when: false

      always:
        - name: Test - clean up generated certificate
          file:
            path: "{{ __certificate_default_directory }}/certs/monger-cockpit.crt"
            state: absent

        - name: Test - clean up generated private key
          file:
            path: "{{ __certificate_default_directory }}/private/monger-cockpit.key"
            state: absent

        - name: Test - clean up copied certificate
          file:
            path: /etc/cockpit/ws-certs.d/monger-cockpit.cert
            state: absent

        - name: Test - generic cleanup
          include_tasks: tasks/cleanup.yml
