# SPDX-License-Identifier: MIT
---
- name: Minimal cluster configuration, custom and regenerated PSKs
  hosts: all
  vars_files: vars/main.yml
  vars:
    ha_cluster_cluster_name: test-cluster
    # use a custom key for corosync
    # generate a new key for pacemaker, even if there already is a key
    # generate a new key for fence_xvm as there is no key present
    # generate a new TLS certificate - key pair for pcsd, even if there already
    #   is one
    ha_cluster_regenerate_keys: true
    ha_cluster_corosync_key_src: >-
      {{ __ha_cluster_work_dir.path }}/corosync-authkey
    __test_pacemaker_key_content: key content to be replaced
    __test_pcsd_private_key_path: "{{ __ha_cluster_work_dir.path }}/pcsd.key"
    __test_pcsd_public_key_path: "{{ __ha_cluster_work_dir.path }}/pcsd.crt"

  tasks:
    - name: Run test
      tags:
        - tests::booted
        - tests::verify
      block:
        - name: Skip test in bootc mode
          include_tasks: tasks/skip_if_bootc.yml

        - name: Create temp directory for secrets
          tempfile:
            state: directory
            prefix: lsr_ha_cluster_
          register: __ha_cluster_work_dir
          delegate_to: localhost
          run_once: true  # noqa: run_once[task]

        - name: Set up test environment
          include_role:
            name: linux-system-roles.ha_cluster
            tasks_from: test_setup.yml

        - name: Run PSKs and certificates fixture
          include_tasks: tasks/fixture_psks.yml

        - name: Ensure directories for keys exist
          file:
            path: "{{ item }}"
            state: directory
            owner: root
            group: root
            mode: "0755"
          loop:
            - /etc/pacemaker
            - /var/lib/pcsd

        - name: Ensure pacemaker key is present
          copy:
            content: "{{ __test_pacemaker_key_content }}"
            dest: /etc/pacemaker/authkey
            owner: root
            group: root
            mode: "0400"

        - name: Ensure fence-virt key is not present
          file:
            path: /etc/cluster/fence_xvm.key
            state: absent
          when: __test_fence_virt_supported

        - name: Distribute pcsd TLS private key
          copy:
            src: "{{ __test_pcsd_private_key_path }}"
            dest: /var/lib/pcsd/pcsd.key
            owner: root
            group: root
            mode: "0600"

        - name: Distribute pcsd TLS certificate
          copy:
            src: "{{ __test_pcsd_public_key_path }}"
            dest: /var/lib/pcsd/pcsd.crt
            owner: root
            group: root
            mode: "0600"

        - name: Get corosync key hash
          stat:
            path: "{{ ha_cluster_corosync_key_src }}"
            checksum_algorithm: sha1
          register: stat_corosync_key_expected
          delegate_to: localhost

        - name: Get pcsd TLS private key hash
          stat:
            path: "{{ __test_pcsd_private_key_path }}"
            checksum_algorithm: sha1
          register: stat_pcsd_key_expected
          delegate_to: localhost

        - name: Get pcsd TLS certificate hash
          stat:
            path: "{{ __test_pcsd_public_key_path }}"
            checksum_algorithm: sha1
          register: stat_pcsd_cert_expected
          delegate_to: localhost

        - name: Run HA Cluster role
          include_role:
            name: linux-system-roles.ha_cluster
            public: true

        - name: Stat corosync authkey
          stat:
            path: /etc/corosync/authkey
            checksum_algorithm: sha1
          register: stat_corosync_key

        - name: Stat pacemaker authkey
          stat:
            path: /etc/pacemaker/authkey
            checksum_algorithm: sha1
          register: stat_pacemaker_key

        - name: Stat fence-virt authkey
          stat:
            path: /etc/cluster/fence_xvm.key
            checksum_algorithm: sha1
          register: stat_fence_xvm_key
          when: __test_fence_virt_supported

        - name: Stat pcsd TLS certificate
          stat:
            path: /var/lib/pcsd/pcsd.crt
            checksum_algorithm: sha1
          register: stat_pcsd_cert

        - name: Stat pcsd TLS private key
          stat:
            path: /var/lib/pcsd/pcsd.key
            checksum_algorithm: sha1
          register: stat_pcsd_key

        - name: Check pre-shared keys are present
          assert:
            that:
              - stat_corosync_key.stat.exists
              - stat_pacemaker_key.stat.exists
              - (
                  not __test_fence_virt_supported
                  or stat_fence_xvm_key.stat.exists
                )
              - stat_pcsd_cert.stat.exists
              - stat_pcsd_key.stat.exists

        - name: Check corosync key content
          assert:
            that:
              - >
                stat_corosync_key.stat.checksum
                == stat_corosync_key_expected.stat.checksum

        - name: Check pacemaker key content
          assert:
            that:
              - >
                stat_pacemaker_key.stat.checksum
                != __test_pacemaker_key_content | hash('sha1')

        - name: Check pcsd TLS certificate content
          assert:
            that:
              - >
                stat_pcsd_cert.stat.checksum
                != stat_pcsd_cert_expected.stat.checksum

        - name: Check pcsd TLS private key content
          assert:
            that:
              - >
                stat_pcsd_key.stat.checksum
                != stat_pcsd_key_expected.stat.checksum

        - name: Check cluster status
          include_tasks: tasks/assert_cluster_running.yml

        - name: Check firewall and selinux state
          include_tasks: tasks/check_firewall_selinux.yml

      always:
        - name: Ensure keys/certs are removed
          file:
            path: "{{ item }}"
            state: absent
          loop:
            - /etc/corosync/authkey
            - /etc/pacemaker/authkey
            - /etc/cluster/fence_xvm.key
            - /var/lib/pcsd/pcsd.crt
            - /var/lib/pcsd/pcsd.key

        - name: Clean up work directory
          file:
            path: "{{ __ha_cluster_work_dir.path }}"
            state: absent
          delegate_to: localhost
          run_once: true  # noqa: run_once[task]

        - name: Reset crypto policies
          include_role:
            name: fedora.linux_system_roles.crypto_policies
          vars:
            crypto_policies_policy: "{{ __crypto_policies_policy }}"
          when: __crypto_policies_policy | d('') | length > 0
