# SPDX-License-Identifier: MIT
---
- name: >-
    Minimal cluster configuration, custom pcsd TLS certificate -
    using the certificate role
  hosts: all
  vars_files: vars/main.yml
  vars:
    ha_cluster_cluster_name: test-cluster
    __cert_name: pcsd_cert

  tasks:
    - name: Run test
      tags:
        - tests::booted
        - tests::verify
      block:
        - name: Skip test in bootc mode
          include_tasks: tasks/skip_if_bootc.yml

        - name: Remove pcsd TLS certificate and key files
          file:
            path: "{{ item }}"
            state: absent
          loop:
            - /var/lib/pcsd/pcsd.crt
            - /var/lib/pcsd/pcsd.key

        - name: Set up test environment
          include_role:
            name: linux-system-roles.ha_cluster
            tasks_from: test_setup.yml

        - name: Run HA Cluster role
          include_role:
            name: linux-system-roles.ha_cluster
            public: true
          vars:
            ha_cluster_pcsd_certificates:
              - name: "{{ __cert_name }}"
                common_name: "{{ ansible_facts['hostname'] }}"
                ca: self-sign

        - name: Stat pcsd TLS certificate
          stat:
            path: /var/lib/pcsd/pcsd.crt
            checksum_algorithm: sha1
          register: stat_pcsd_cert

        - name: Stat pcsd TLS key
          stat:
            path: /var/lib/pcsd/pcsd.key
            checksum_algorithm: sha1
          register: stat_pcsd_key

        - name: Check pre-shared keys and TLS certificates are present
          assert:
            that:
              - stat_pcsd_cert.stat.exists
              - stat_pcsd_key.stat.exists

        - name: Check firewall and selinux state
          include_tasks: tasks/check_firewall_selinux.yml

      always:
        - name: Stop tracking certificate
          # note - configure-shell.yml overrides the certificate name
          command: getcert stop-tracking -f /var/lib/pcsd/pcsd.crt
          changed_when: false

        - name: Remove pcsd TLS certificate and key files
          file:
            path: "{{ item }}"
            state: absent
          loop:
            - /var/lib/pcsd/pcsd.crt
            - /var/lib/pcsd/pcsd.key
