# SPDX-License-Identifier: MIT
---
# Assume firewalld and selinux are not manually configured.
- name: Check firewall
  when:
    - metrics_provider == 'pcp'
    - ansible_facts['os_family'] == 'RedHat'
    - ansible_facts['distribution_version'] is version('7', '>=')
    - metrics_manage_firewall | bool
  block:
    - name: "Check firewall service status for grafana;
             metrics_manage_firewall is true"
      command: firewall-cmd --list-services
      register: _result
      failed_when:
        - "'grafana' not in _result.stdout"
      changed_when: false
      when:
        - metrics_graph_service|d(false)|bool

    - name: "Check firewall service status for redis;
             metrics_manage_firewall is true"
      command: firewall-cmd --list-services
      register: _result
      failed_when: "'redis' not in _result.stdout"
      changed_when: false
      when:
        - metrics_query_service|d(false)|bool

    - name: "Check firewall port status for pmproxy;
             metrics_manage_firewall is true"
      command: firewall-cmd --list-ports
      register: _result
      failed_when:
        - "'44322/tcp' not in _result.stdout"
      changed_when: false
      when:
        - metrics_graph_service|d(false)|bool or
          metrics_query_service|d(false)|bool

    - name: "Check firewall port status for pmcd;
             metrics_manage_firewall is true"
      command: firewall-cmd --list-ports
      register: _result
      failed_when: "'44321/tcp' not in _result.stdout"
      changed_when: false

- name: Check associated selinux ports (metrics_manage_selinux is true)
  shell: |-
    set -euo pipefail
    semanage boolean --list | egrep "pcp_bind_all_unreserved_ports *\(on "
  changed_when: false
  when: metrics_manage_selinux | bool
