---

- name: Prepare, test fixtures
  hosts: localhost
  connection: local
  gather_facts: false
  tasks:

    - name: Initialise CA hierarchy
      ansible.builtin.command: "gimmecert init"
      args:
        creates: ".gimmecert/ca/level1.cert.pem"
        chdir: "tests/data/"

    - name: Generate server private keys and certificates
      ansible.builtin.command:
      args:
        chdir: "tests/data/"
        creates: ".gimmecert/server/{{ item.name }}.cert.pem"
        argv:
          - "gimmecert"
          - "server"
          - "{{ item.name }}"
          - "{{ item.fqdn }}"
      with_items:
        - name: mail-server_smtp
          fqdn: mail-server

    - name: Set-up link to generated X.509 material
      ansible.builtin.file:
        src: ".gimmecert"
        dest: "tests/data/x509"
        state: link

- name: Prepare
  hosts: all
  become: true
  gather_facts: false
  tasks:

    - name: Install python for Ansible
      ansible.builtin.raw: test -e /usr/bin/python3 || (apt -y update && apt install -y python3-minimal)
      changed_when: false

    - name: Update all caches to avoid errors due to missing remote archives
      ansible.builtin.apt:
        update_cache: true
      changed_when: false

    - name: Set-up the hosts file
      ansible.builtin.lineinfile:
        path: /etc/hosts
        regexp: "^{{ item.key }}"
        line: "{{ item.key }} {{ item.value }}"
        owner: root
        group: root
        mode: "0644"
        state: present
      with_dict:
        192.168.56.11: "mail-server domain1"
        192.168.56.12: "client1"
        192.168.56.21: "parameters-mandatory-bookworm"
        192.168.56.22: "parameters-optional-bookworm"
        192.168.56.23: "parameters-no-incoming-bookworm"

    - name: Install tools for testing
      ansible.builtin.apt:
        name: gnutls-bin
        state: present

- name: Prepare, helpers
  hosts: clients
  become: true
  tasks:

    - name: Install SWAKS for testing SMTP capability
      ansible.builtin.apt:
        name: swaks
        state: present

    - name: Install tool for testing TCP connectivity
      ansible.builtin.apt:
        name: hping3
        state: present

    - name: Deploy CA certificate
      ansible.builtin.copy:
        src: tests/data/x509/ca/level1.cert.pem
        dest: /usr/local/share/ca-certificates/testca.crt
        owner: root
        group: root
        mode: "0644"
      notify:
        - Update CA certificate cache

  handlers:

    - name: Update CA certificate cache  # noqa no-changed-when
      # [no-changed-when] Commands should not change things if nothing needs doing
      #   Does not matter in test prepare stage.
      ansible.builtin.command: /usr/sbin/update-ca-certificates --fresh

- name: Prepare, helpers
  hosts: mail-servers
  become: true
  tasks:

    - name: Deploy CA certificate
      ansible.builtin.copy:
        src: tests/data/x509/ca/level1.cert.pem
        dest: /usr/local/share/ca-certificates/testca.crt
        owner: root
        group: root
        mode: "0644"
      notify:
        - Update CA certificate cache

    - name: Deploy SMTP private key and certificate
      ansible.builtin.copy:
        src: "tests/data/x509/server/{{ item }}"
        dest: "/etc/ssl/{{ item }}"
        owner: root
        group: root
        mode: "0600"
      with_items:
        - mail-server_smtp.cert.pem
        - mail-server_smtp.key.pem

    - name: Install Postfix
      ansible.builtin.apt:
        name: "postfix"
        state: present

    - name: Purge Exim configuration
      ansible.builtin.apt:
        name: "exim4*"
        state: absent
        purge: true

    - name: Deploy Postfix configuration
      ansible.builtin.copy:
        src: tests/data/main.cf
        dest: /etc/postfix/main.cf
        owner: root
        group: root
        mode: "0644"
      notify:
        - Restart Postfix

    - name: Install tool for testing TCP connectivity
      ansible.builtin.apt:
        name: hping3
        state: present

    - name: Install SWAKS for testing SMTP capability
      ansible.builtin.apt:
        name: swaks
        state: present

    - name: Set-up port forwarding
      ansible.builtin.command: "iptables -t nat -A PREROUTING -p tcp -m tcp --dport 27 -j REDIRECT --to-ports 25"
      changed_when: false

  handlers:

    - name: Update CA certificate cache  # noqa no-changed-when
      # [no-changed-when] Commands should not change things if nothing needs doing
      #   Does not matter in test prepare stage.
      ansible.builtin.command: /usr/sbin/update-ca-certificates --fresh

    - name: Restart Postfix
      ansible.builtin.service:
        name: postfix
        state: restarted

- name: Prepare, test fixtures
  hosts: parameters-optional
  become: true
  tasks:

    - name: Create additional group for testing local aliases
      ansible.builtin.group:
        name: testuser

    - name: Create additional user for testing local aliases
      ansible.builtin.user:
        name: testuser
        group: testuser