# SPDX-License-Identifier: MIT
---
- name: Minimal cluster configuration, custom pcsd TLS certificate - key pair
  hosts: all
  vars_files: vars/main.yml
  vars:
    ha_cluster_cluster_name: test-cluster
    ha_cluster_pcsd_public_key_src: "{{ __ha_cluster_work_dir.path }}/pcsd.crt"
    ha_cluster_pcsd_private_key_src: "{{ __ha_cluster_work_dir.path }}/pcsd.key"
  tasks:
    - name: Run test
      tags:
        - tests::booted
        - tests::verify
      block:
        - name: Skip test in bootc mode
          include_tasks: tasks/skip_if_bootc.yml

        - name: Create temp directory for secrets
          tempfile:
            state: directory
            prefix: lsr_ha_cluster_
          register: __ha_cluster_work_dir
          delegate_to: localhost
          run_once: true  # noqa: run_once[task]

        - name: Set up test environment
          include_role:
            name: linux-system-roles.ha_cluster
            tasks_from: test_setup.yml

        - name: Run PSKs and certificates fixture
          include_tasks: tasks/fixture_psks.yml

        - name: Get pcsd TLS private key hash
          stat:
            path: "{{ ha_cluster_pcsd_private_key_src }}"
            checksum_algorithm: sha1
          register: stat_pcsd_key_expected
          delegate_to: localhost

        - name: Get pcsd TLS certificate hash
          stat:
            path: "{{ ha_cluster_pcsd_public_key_src }}"
            checksum_algorithm: sha1
          register: stat_pcsd_cert_expected
          delegate_to: localhost

        - name: Run HA Cluster role
          include_role:
            name: linux-system-roles.ha_cluster
            public: true

        - name: Stat pcsd TLS certificate
          stat:
            path: /var/lib/pcsd/pcsd.crt
            checksum_algorithm: sha1
          register: stat_pcsd_cert

        - name: Stat pcsd TLS key
          stat:
            path: /var/lib/pcsd/pcsd.key
            checksum_algorithm: sha1
          register: stat_pcsd_key

        - name: Check pre-shared keys and TLS certificates are present
          assert:
            that:
              - stat_pcsd_cert.stat.exists
              - stat_pcsd_key.stat.exists

        - name: Check pcsd TLS certificate content
          assert:
            that:
              - >
                stat_pcsd_cert.stat.checksum
                == stat_pcsd_cert_expected.stat.checksum

        - name: Check pcsd TLS key content
          assert:
            that:
              - >
                stat_pcsd_key.stat.checksum
                == stat_pcsd_key_expected.stat.checksum

        - name: Check firewall and selinux state
          include_tasks: tasks/check_firewall_selinux.yml

      rescue:
        - name: Dump journal, logs
          shell: |
            set -x
            exec 1>&2
            journalctl -ex
            for file in /var/log/pcsd/*.log; do
              echo "--- $file ---"
              cat "$file"
            done
            for file in /var/log/pacemaker/*.log; do
              echo "--- $file ---"
              cat "$file"
            done
          changed_when: false
          failed_when: true

      always:
        - name: Remove pcsd TLS certificate and key files
          file:
            path: "{{ item }}"
            state: absent
          loop:
            - /var/lib/pcsd/pcsd.crt
            - /var/lib/pcsd/pcsd.key

        - name: Clean up work directory
          file:
            path: "{{ __ha_cluster_work_dir.path }}"
            state: absent
          delegate_to: localhost
          run_once: true  # noqa: run_once[task]

        - name: Reset crypto policies
          include_role:
            name: fedora.linux_system_roles.crypto_policies
          vars:
            crypto_policies_policy: "{{ __crypto_policies_policy }}"
          when: __crypto_policies_policy | d("") | length > 0
