# SPDX-License-Identifier: MIT
---
- name: Manage firewall
  when:
    - metrics_manage_firewall | bool
    - ansible_facts['os_family'] == 'RedHat'
    - ansible_facts['distribution_version'] is version('7', '>=')
  block:
    - name: Initialize __metrics_firewall
      set_fact:
        __metrics_firewall: []

    - name: Port for pmcd
      set_fact:
        __metrics_firewall:
          - {'port': '44321/tcp', 'state': 'enabled'}
      when: metrics_provider == 'pcp'

    - name: Port for pmproxy used by query and grafana
      set_fact:
        __metrics_firewall: "{{ __metrics_firewall |
            union([{'port': '44322/tcp', 'state': 'enabled'}]) }}"
      when:
        - metrics_graph_service|bool or metrics_query_service|bool

    - name: Service for grafana
      set_fact:
        __metrics_firewall: "{{ __metrics_firewall |
            union([{'service': 'grafana', 'state': 'enabled'}]) }}"
      when:
        - metrics_graph_service|bool

    - name: Service for redis
      set_fact:
        __metrics_firewall: "{{ __metrics_firewall |
            union([{'service': 'redis', 'state': 'enabled'}]) }}"
      when:
        - metrics_query_service|bool

    - name: Ensure the service and the port status with the firewall role
      include_role:
        name: fedora.linux_system_roles.firewall
      vars:
        firewall: "{{ __metrics_firewall }}"
