# SPDX-License-Identifier: MIT
---
- name: Minimal cluster configuration, custom pcsd TLS certificate - key pair
  hosts: all
  vars_files: vars/main.yml
  vars:
    ha_cluster_cluster_name: test-cluster
    ha_cluster_pcsd_public_key_src: "{{ __ha_cluster_work_dir.path }}/pcsd.crt"
    ha_cluster_pcsd_private_key_src: "{{ __ha_cluster_work_dir.path }}/pcsd.key"
  tasks:
    - name: Run test
      tags: tests::verify
      block:
        - name: Create temp directory for secrets
          tempfile:
            state: directory
            prefix: lsr_ha_cluster_
          register: __ha_cluster_work_dir
          delegate_to: localhost
          run_once: true  # noqa: run_once[task]

        - name: Set up test environment
          include_role:
            name: linux-system-roles.ha_cluster
            tasks_from: test_setup.yml

        - name: Run PSKs and certificates fixture
          include_tasks: tasks/fixture_psks.yml

        - name: Get pcsd TLS private key hash
          stat:
            path: "{{ ha_cluster_pcsd_private_key_src }}"
            checksum_algorithm: sha1
          register: stat_pcsd_key_expected
          delegate_to: localhost

        - name: Get pcsd TLS certificate hash
          stat:
            path: "{{ ha_cluster_pcsd_public_key_src }}"
            checksum_algorithm: sha1
          register: stat_pcsd_cert_expected
          delegate_to: localhost

        - name: Run HA Cluster role
          include_role:
            name: linux-system-roles.ha_cluster
            public: true

        - name: Stat pcsd TLS certificate
          stat:
            path: /var/lib/pcsd/pcsd.crt
            checksum_algorithm: sha1
          register: stat_pcsd_cert

        - name: Stat pcsd TLS key
          stat:
            path: /var/lib/pcsd/pcsd.key
            checksum_algorithm: sha1
          register: stat_pcsd_key

        - name: Check pre-shared keys and TLS certificates are present
          assert:
            that:
              - stat_pcsd_cert.stat.exists
              - stat_pcsd_key.stat.exists

        - name: Check pcsd TLS certificate content
          assert:
            that:
              - >
                stat_pcsd_cert.stat.checksum
                == stat_pcsd_cert_expected.stat.checksum

        - name: Check pcsd TLS key content
          assert:
            that:
              - >
                stat_pcsd_key.stat.checksum
                == stat_pcsd_key_expected.stat.checksum

        - name: Check firewall and selinux state
          include_tasks: tasks/check_firewall_selinux.yml
      always:
        - name: Clean up work directory
          file:
            path: "{{ __ha_cluster_work_dir.path }}"
            state: absent
          delegate_to: localhost
          run_once: true  # noqa: run_once[task]
