---

- name: Create

  hosts: localhost

  connection: local

  gather_facts: False

  no_log: "{{ not lookup('env', 'MOLECULE_DEBUG') | bool }}"

  vars:

    molecule_file: "{{ lookup('env', 'MOLECULE_FILE') }}"

    molecule_instance_config: "{{ lookup('env', 'MOLECULE_INSTANCE_CONFIG') }}"

    molecule_yml: "{{ lookup('file', molecule_file) | molecule_from_yaml }}"

  tasks:

    - name: Create molecule instance(s)

      molecule_vagrant:

        instance_name: "{{ item.name }}"

        instance_interfaces: "{{ item.interfaces | default(omit) }}"

        instance_raw_config_args: "{{ item.instance_raw_config_args | default(omit) }}"

        platform_box: "{{ item.box }}"

        platform_box_version: "{{ item.box_version | default(omit) }}"

        platform_box_url: "{{ item.box_url | default(omit) }}"

        provider_name: "{{ molecule_yml.driver.provider.name }}"

        provider_memory: "{{ item.memory | default(omit) }}"

        provider_cpus: "{{ item.cpus | default(omit) }}"

        provider_raw_config_args: "{{ item.raw_config_args | default(omit) }}"

        state: up

      register: server

      with_items: "{{ molecule_yml.platforms }}"

    # Mandatory configuration for Molecule to function.

    - name: Populate instance config dict

      set_fact:

        instance_conf_dict: {

          'instance': "{{ item.Host }}",

          'address': "{{ item.HostName }}",

          'user': "{{ item.User }}",

          'port': "{{ item.Port }}",

          'identity_file': "{{ item.IdentityFile }}", }

      with_items: "{{ server.results }}"

      register: instance_config_dict

      when: server.changed | bool

    - name: Convert instance config dict to a list

      set_fact:

        instance_conf: "{{ instance_config_dict.results | map(attribute='ansible_facts.instance_conf_dict') | list }}"

      when: server.changed | bool

    - name: Dump instance config

      copy:

        # NOTE(retr0h): Workaround for Ansible 2.2.

        #               https://github.com/ansible/ansible/issues/20885

        content: "{{ instance_conf | to_json | from_json | molecule_to_yaml | molecule_header }}"

        dest: "{{ molecule_instance_config }}"

      when: server.changed | bool

---

- name: Destroy

  hosts: localhost

  connection: local

  gather_facts: False

  no_log: "{{ not lookup('env', 'MOLECULE_DEBUG') | bool }}"

  vars:

    molecule_file: "{{ lookup('env', 'MOLECULE_FILE') }}"

    molecule_instance_config: "{{ lookup('env',' MOLECULE_INSTANCE_CONFIG') }}"

    molecule_yml: "{{ lookup('file', molecule_file) | molecule_from_yaml }}"

  tasks:

    - name: Destroy molecule instance(s)

      molecule_vagrant:

        instance_name: "{{ item.name }}"

        platform_box: "{{ item.box }}"

        provider_name: "{{ molecule_yml.driver.provider.name }}"

        force_stop: "{{ item.force_stop | default(True) }}"

        state: destroy

      register: server

      with_items: "{{ molecule_yml.platforms }}"

    # Mandatory configuration for Molecule to function.

    - name: Populate instance config

      set_fact:

        instance_conf: {}

    - name: Dump instance config

      copy:

        # NOTE(retr0h): Workaround for Ansible 2.2.

        #               https://github.com/ansible/ansible/issues/20885

        content: "{{ instance_conf | to_json | from_json | molecule_to_yaml | molecule_header }}"

        dest: "{{ molecule_instance_config }}"

      when: server.changed | bool

---

dependency: {}

driver:

  name: vagrant

  provider:

    name: virtualbox

lint:

  name: yamllint

platforms:

  - name: helper

    box: debian/contrib-jessie64

    memory: 512

    cpus: 1

    interfaces:

      - auto_config: true

        ip: 10.31.127.2

        network_name: private_network

        type: static

  - name: parameters-mandatory-jessie64

    groups:

      - parameters-mandatory

    box: debian/contrib-jessie64

    memory: 256

    cpus: 1

    interfaces:

      - auto_config: true

        ip: 10.31.127.3

        network_name: private_network

        type: static

  - name: parameters-optional-jessie64

    groups:

      - parameters-optional

    box: debian/contrib-jessie64

    memory: 256

    cpus: 1

    interfaces:

      - auto_config: true

        ip: 10.31.127.4

        network_name: private_network

        type: static

  - name: parameters-mandatory-stretch64

    groups:

      - parameters-mandatory

    box: debian/contrib-stretch64

    memory: 256

    cpus: 1

    interfaces:

      - auto_config: true

        ip: 10.31.127.5

        network_name: private_network

        type: static

  - name: parameters-optional-stretch64

    groups:

      - parameters-optional

    box: debian/contrib-stretch64

    memory: 256

    cpus: 1

    interfaces:

      - auto_config: true

        ip: 10.31.127.6

        network_name: private_network

        type: static

provisioner:

  name: ansible

  config_options:

    ssh_connection:

      pipelining: "True"

  lint:

    name: ansible-lint

scenario:

  name: default

verifier:

  name: testinfra

  lint:

    name: flake8

  become: yes

  become: yes

  become: yes

---

- name: Prepare

  hosts: all

  gather_facts: False

  tasks:

    - name: Install python for Ansible

      raw: test -e /usr/bin/python || (apt -y update && apt install -y python-minimal)

      become: True

      changed_when: False

- hosts: all

  become: yes

  tasks:

    - name: Update all caches to avoid errors due to missing remote archives

      apt:

        update_cache: yes

      changed_when: False

    - name: Install net-tools for running Testinfra host.socket tests

      apt:

        name: net-tools

        state: present

    '.molecule/ansible_inventory.yml').get_hosts('all')

def test_pam_umask(host):

    pam_auth_update_config = host.file('/usr/share/pam-configs/umask')

    assert host.file('/etc/pam.d/common-session').contains('session[[:blank:]]\+required[[:blank:]]\+pam_umask.so')

    assert host.file('/etc/pam.d/common-session-noninteractive').contains('session[[:blank:]]\+required[[:blank:]]\+pam_umask.so')

def test_login_umask(host):

    assert host.file('/etc/login.defs').contains('UMASK[[:blank:]]\+027')

def test_adduser_umask(host):

    assert host.file('/etc/adduser.conf').contains('DIR_MODE=0750')

def test_bash_prompt(host):

    bash_prompt = host.file('/etc/profile.d/bash_prompt.sh')

def test_home_profile_d(host):

    home_profile_d = host.file('/etc/profile.d/z99-user_profile_d.sh')

def test_home_skeleton_bashrc(host):

    bashrc = host.file('/etc/skel/.bashrc')

def test_default_bashrc(host):

    bashrc = host.file('/etc/bash.bashrc')

def test_root_bashrc(host):

    with host.sudo():

        bashrc = host.file('/root/.bashrc')

def test_installed_packages(host):

    assert host.package('sudo').is_installed

    assert host.package('ssl-cert').is_installed

    assert host.package('rcconf').is_installed

    assert host.package('ferm').is_installed

    assert host.package('apticron').is_installed

    assert host.package('virtualenv').is_installed

def test_root_remote_login_disabled(host):

    assert 'PermitRootLogin no' in host.file('/etc/ssh/sshd_config').content

def test_remote_login_via_password_disabled(host):

    assert 'PasswordAuthentication no' in host.file('/etc/ssh/sshd_config').content

def test_ferm_service_configuration(host):

    ferm_service_config = host.file('/etc/default/ferm')

def test_ferm_configuration_directory(host):

    with host.sudo():

        ferm_dir = host.file('/etc/ferm/conf.d')

def test_ferm_configuration(host):

    with host.sudo():

        ferm_configuration = host.file('/etc/ferm/ferm.conf')

        ferm_base = host.file('/etc/ferm/conf.d/00-base.conf')

def test_ferm_service(host):

    ferm = host.service('ferm')

def test_check_certificate_script(host):

    check_certificate = host.file('/usr/local/bin/check_certificate.sh')

def test_check_certificate_directory(host):

    check_certificate_dir = host.file('/etc/check_certificate')

def test_check_certificate_crontab(host):

    check_certificate_crontab = host.file('/etc/cron.d/check_certificate')

def test_pipreqcheck_virtualenv(host):

    with host.sudo():

        virtualenv_activate = host.file('/var/lib/pipreqcheck/virtualenv/bin/activate')

def test_pipreqcheck_directories(host):

    with host.sudo():

        pipreqcheck_config_directory = host.file('/etc/pip_check_requirements_upgrades')

        pipreqcheck_config_directory_pipreqcheck = host.file('/etc/pip_check_requirements_upgrades/pipreqcheck')

def test_pipreqcheck_requirements(host):

    with host.sudo():

        requirements_in = host.file('/etc/pip_check_requirements_upgrades/pipreqcheck/requirements.in')

        requirements_txt = host.file('/etc/pip_check_requirements_upgrades/pipreqcheck/requirements.txt')

def test_pipreqcheck_packages(host):

    with host.sudo():

        packages = host.pip_package.get_packages(pip_path='/var/lib/pipreqcheck/virtualenv/bin/pip')

def test_pipreqcheck_script(host):

    pipreqcheck_script = host.file('/usr/local/bin/pip_check_requirements_upgrades.sh')

def test_pipreqcheck_crontab(host):

    crontab = host.file('/etc/cron.d/check_pip_requirements')

    '.molecule/ansible_inventory.yml').get_hosts('parameters-mandatory')

def test_apt_proxy(host):

    assert not host.file('/etc/apt/apt.conf.d/00proxy').exists

def test_bash_prompt_content(host):

    bash_prompt = host.file('/etc/profile.d/bash_prompt.sh')

def test_ssh_login_mechanisms(host):

    # Extract first non-IPv6 IP. Crude test, but it should work.

    remote_ip = next(a for a in host.interface("eth1").addresses if ":" not in a)

    sock.connect((remote_ip, 22))

def test_mariadb_mysql_config_symlink(host):

    mysql_config = host.file('/usr/bin/mysql_config')

def test_emacs_electric_indent_mode(host):

    emacs_config = host.file('/etc/emacs/site-start.d/01disable-electric-indent-mode')

def test_ferm_base_rules(host):

    with host.sudo():

        ferm_base = host.file('/etc/ferm/conf.d/00-base.conf')

        iptables = host.command('iptables-save')

        ip6tables = host.command('ip6tables-save')

def test_pipreqcheck_virtualenv_user(host):

    group = host.group('pipreqcheck')

    user = host.user('pipreqcheck')

def test_backup_configuration_absent(host):

    with host.sudo():

        assert not host.file('/etc/duply/main/patterns/common').exists

def test_ntp_software_not_installed(host):

    # assert not host.package('ntp').is_installed

    # assert not host.package('ntpdate').is_installed

def test_ntp_listening_interfaces(host):

    assert not host.socket('udp://:::123').is_listening