# SPDX-License-Identifier: MIT
---
- name: Check firewall and SELinux port status for custom port
  vars:
    _cockpit_port: "{{ cockpit_port if cockpit_port is not none else 9090 }}"
  when: ansible_facts['os_family'] == 'RedHat'
  block:
    - name: Check firewall port status
      when: cockpit_manage_firewall | bool
      block:
        - name: Check firewall port status when cockpit_manage_firewall is yes
          command: firewall-cmd --list-service
          register: _result
          failed_when: "'cockpit' not in _result.stdout"
          changed_when: false
          when:
            - _cockpit_port | int == 9090

        - name: >-
            Check firewall port status when cockpit_manage_firewall is yes
          command: firewall-cmd --list-port
          register: _result
          failed_when: "'{{ _cockpit_port }}/tcp' not in _result.stdout"
          changed_when: false
          when:
            - _cockpit_port | int != 9090

    - name: Check SELinux port labeling
      when: cockpit_manage_selinux | bool
      block:
        - name: Install SELinux tools
          include_tasks: install_selinux_tools.yml

        - name: >-
            Check associated selinux ports when cockpit_manage_selinux is yes
          shell: |-
            set -eu
            if set -o | grep -q pipefail; then
              set -o pipefail  # no pipefail on debian, some ubuntu
            fi
            semanage port --list | egrep "websm_port_t *tcp" | \
              grep "{{ _cockpit_port }}"
          changed_when: false
