# SPDX-License-Identifier: MIT
---
- name: Check firewall
  when: ha_cluster_manage_firewall | bool
  block:
    - name: Check firewall service status
      command: firewall-cmd --list-services
      register: _result
      failed_when: "'high-availability' not in _result.stdout"
      changed_when: false

    - name: Check firewall port status
      when: ansible_facts['architecture'] == 'x86_64'
      command: firewall-cmd --list-ports
      register: _result
      failed_when: "'1229/tcp' not in _result.stdout"
      changed_when: false

- name: Check SELinux
  when:
    - '"firewalld.service" in ansible_facts.services'
    - ansible_facts.services["firewalld.service"]["state"] == "running"
    - ha_cluster_manage_selinux | bool
  block:
    - name: Get associated selinux ports
      shell: |-
        set -euo pipefail
        firewall-cmd --info-service=high-availability | \
          egrep " +ports: +" | sed -e "s/ *ports: //"
      register: __ports
      changed_when: false

    - name: Check associated selinux ports
      shell: |-
        set -euo pipefail
        sudo semanage port --list | grep cluster_port_t | \
          grep "{{ _pair[0] }}" | grep "{{ _pair[1] }}"
      vars:
        _pair: "{{ item.split('/') }}"
      loop: "{{ __ports.stdout.split(' ') }}"
      changed_when: false
