---

- name: Create

  hosts: localhost

  connection: local

  gather_facts: False

  no_log: "{{ not lookup('env', 'MOLECULE_DEBUG') | bool }}"

  vars:

    molecule_file: "{{ lookup('env', 'MOLECULE_FILE') }}"

    molecule_instance_config: "{{ lookup('env', 'MOLECULE_INSTANCE_CONFIG') }}"

    molecule_yml: "{{ lookup('file', molecule_file) | molecule_from_yaml }}"

  tasks:

    - name: Create molecule instance(s)

      molecule_vagrant:

        instance_name: "{{ item.name }}"

        instance_interfaces: "{{ item.interfaces | default(omit) }}"

        instance_raw_config_args: "{{ item.instance_raw_config_args | default(omit) }}"

        platform_box: "{{ item.box }}"

        platform_box_version: "{{ item.box_version | default(omit) }}"

        platform_box_url: "{{ item.box_url | default(omit) }}"

        provider_name: "{{ molecule_yml.driver.provider.name }}"

        provider_memory: "{{ item.memory | default(omit) }}"

        provider_cpus: "{{ item.cpus | default(omit) }}"

        provider_raw_config_args: "{{ item.raw_config_args | default(omit) }}"

        state: up

      register: server

      with_items: "{{ molecule_yml.platforms }}"

    # Mandatory configuration for Molecule to function.

    - name: Populate instance config dict

      set_fact:

        instance_conf_dict: {

          'instance': "{{ item.Host }}",

          'address': "{{ item.HostName }}",

          'user': "{{ item.User }}",

          'port': "{{ item.Port }}",

          'identity_file': "{{ item.IdentityFile }}", }

      with_items: "{{ server.results }}"

      register: instance_config_dict

      when: server.changed | bool

    - name: Convert instance config dict to a list

      set_fact:

        instance_conf: "{{ instance_config_dict.results | map(attribute='ansible_facts.instance_conf_dict') | list }}"

      when: server.changed | bool

    - name: Dump instance config

      copy:

        # NOTE(retr0h): Workaround for Ansible 2.2.

        #               https://github.com/ansible/ansible/issues/20885

        content: "{{ instance_conf | to_json | from_json | molecule_to_yaml | molecule_header }}"

        dest: "{{ molecule_instance_config }}"

      when: server.changed | bool

---

- name: Destroy

  hosts: localhost

  connection: local

  gather_facts: False

  no_log: "{{ not lookup('env', 'MOLECULE_DEBUG') | bool }}"

  vars:

    molecule_file: "{{ lookup('env', 'MOLECULE_FILE') }}"

    molecule_instance_config: "{{ lookup('env',' MOLECULE_INSTANCE_CONFIG') }}"

    molecule_yml: "{{ lookup('file', molecule_file) | molecule_from_yaml }}"

  tasks:

    - name: Destroy molecule instance(s)

      molecule_vagrant:

        instance_name: "{{ item.name }}"

        platform_box: "{{ item.box }}"

        provider_name: "{{ molecule_yml.driver.provider.name }}"

        force_stop: "{{ item.force_stop | default(True) }}"

        state: destroy

      register: server

      with_items: "{{ molecule_yml.platforms }}"

    # Mandatory configuration for Molecule to function.

    - name: Populate instance config

      set_fact:

        instance_conf: {}

    - name: Dump instance config

      copy:

        # NOTE(retr0h): Workaround for Ansible 2.2.

        #               https://github.com/ansible/ansible/issues/20885

        content: "{{ instance_conf | to_json | from_json | molecule_to_yaml | molecule_header }}"

        dest: "{{ molecule_instance_config }}"

      when: server.changed | bool

---

dependency: {}

driver:

  name: vagrant

  provider:

    name: virtualbox

lint:

  name: yamllint

platforms:

  - name: ldap-server

    box: debian/contrib-jessie64

    memory: 512

    cpus: 1

    interfaces:

      - auto_config: true

        ip: 10.31.127.10

        network_name: private_network

        type: static

  - name: client1

    box: debian/contrib-jessie64

    memory: 256

    cpus: 1

    interfaces:

      - auto_config: true

        ip: 10.31.127.20

        network_name: private_network

        type: static

  - name: parameters-mandatory-jessie64.domain1

    groups:

      - parameters-mandatory

    box: debian/contrib-jessie64

    memory: 512

    cpus: 1

    interfaces:

      - auto_config: true

        ip: 10.31.127.30

        network_name: private_network

        type: static

  - name: parameters-optional-jessie64

    groups:

      - parameters-optional

    box: debian/contrib-jessie64

    memory: 512

    cpus: 1

    interfaces:

      - auto_config: true

        ip: 10.31.127.31

        network_name: private_network

        type: static

provisioner:

  name: ansible

  config_options:

    ssh_connection:

      pipelining: "True"

  lint:

    name: ansible-lint

scenario:

  name: default

verifier:

  name: testinfra

  lint:

    name: flake8

---

- hosts: parameters-mandatory

  become: yes

  roles:

    - role: xmpp_server

      xmpp_administrators:

        - john.doe@domain1

      xmpp_ldap_base_dn: dc=local

      xmpp_ldap_password: prosodypassword

      xmpp_ldap_server: ldap-server

      # Common parameters (general, not role).

      tls_certificate_dir: tests/data/x509/

      tls_private_key_dir: tests/data/x509/

      # common

      ca_certificates:

        testca: "{{ lookup('file', 'tests/data/x509/ca.cert.pem') }}"

- hosts: parameters-optional

  become: yes

  roles:

    - role: xmpp_server

      xmpp_administrators:

        - jane.doe@domain2

        - mick.doe@domain3

      xmpp_domains:

        - domain2

        - domain3

      xmpp_ldap_base_dn: dc=local

      xmpp_ldap_password: prosodypassword

      xmpp_ldap_server: ldap-server

      xmpp_tls_certificate: "{{ lookup('file', 'tests/data/x509/parameters-optional_xmpp.cert.pem') }}"

      xmpp_tls_key: "{{ lookup('file', 'tests/data/x509/parameters-optional_xmpp.key.pem') }}"

      # Common parameters (general, not role).

      tls_certificate_dir: tests/data/x509/

      tls_private_key_dir: tests/data/x509/

      # common

      ca_certificates:

        testca: "{{ lookup('file', 'tests/data/x509/ca.cert.pem') }}"

      # backup_client

      enable_backup: yes

      backup_client_username: bak-parameters-optional

      backup_encryption_key: "{{ lookup('file', 'tests/data/gnupg/parameters-optional.asc') }}"

      backup_server: backup-server

      backup_server_host_ssh_public_keys:

        - "{{ lookup('file', 'tests/data/ssh/server_dsa.pub') }}"

        - "{{ lookup('file', 'tests/data/ssh/server_rsa.pub') }}"

        - "{{ lookup('file', 'tests/data/ssh/server_ed25519.pub') }}"

        - "{{ lookup('file', 'tests/data/ssh/server_ecdsa.pub') }}"

      backup_ssh_key: "{{ lookup('file', 'tests/data/ssh/parameters-optional' ) }}"

- name: Prepare

  hosts: all

  gather_facts: False

  tasks:

    - name: Install python for Ansible

      raw: test -e /usr/bin/python || (apt -y update && apt install -y python-minimal)

      become: True

      changed_when: False

  become: yes

    - name: Set-up the hosts file

        path: /etc/hosts

        regexp: "^{{ item.key }}"

        owner: root

        group: root

        mode: 0644

        state: present

  become: yes

  become: yes

  become: yes

    '.molecule/ansible_inventory.yml').get_hosts('parameters-optional')

def test_backup(host):

    send = host.run("echo 'Hello' | sendxmpp -t -u jane.doe -p janepassword -j domain2:5222 jane.doe@domain2")

    send = host.run("echo 'Hello' | sendxmpp -t -u mick.doe -p mickpassword -j domain3:5222 mick.doe@domain3")

    with host.sudo():

        host.run("rm -rf /root/restore")

        backup_run = host.run('duply main backup')

        restore_run = host.run('duply main restore /root/restore')

            directory = host.file(directory_path)

            f = host.file(file_path)

import testinfra.utils.ansible_runner

testinfra_hosts = testinfra.utils.ansible_runner.AnsibleRunner(

    '.molecule/ansible_inventory.yml').get_hosts('client1')

def test_connectivity(host):

    """

    Tests connectivity to the XMPP server (ports that should be reachable).

    """

    with host.sudo():

        for server in ["parameters-mandatory",

                       "parameters-optional"]:

            # c2s plaintext, c2s TLS, file proxy, s2s.

            for port in [5222, 5223, 5000, 5269]:

                ping = host.run('hping3 -S -p %d -c 1 %s' % (port, server))

                assert ping.rc == 0

def test_tls(host):

    """

    Tests if TLS works as expected.

    """

    send = host.run("echo 'Hello' | sendxmpp -t -u john.doe -p johnpassword -j domain1:5222 john.doe@domain1")

    assert send.rc == 0

    send = host.run("echo 'Hello' | sendxmpp -e -u john.doe -p johnpassword -j domain1:5223 john.doe@domain1")

    assert send.rc == 0

    send = host.run("echo 'Hello' | sendxmpp -t -u jane.doe -p janepassword -j domain2:5222 jane.doe@domain2")

    assert send.rc == 0

    send = host.run("echo 'Hello' | sendxmpp -e -u jane.doe -p janepassword -j domain2:5223 jane.doe@domain2")

    assert send.rc == 0

def test_authentication_requires_tls(host):

    """

    Tests if authentication must be done over TLS.

    """

    command = host.run("echo 'Hello' | sendxmpp -u bogus -p bogus -j domain1:5222 john.doe@domain1 -d")

    assert "<starttls xmlns='urn:ietf:params:xml:ns:xmpp-tls'><required/></starttls>" in command.stderr

    command = host.run("echo 'Hello' | sendxmpp -u bogus -p bogus -j domain2:5222 jane.doe@domain2 -d")

    assert "<starttls xmlns='urn:ietf:params:xml:ns:xmpp-tls'><required/></starttls>" in command.stderr

def test_authentication(host):

    """

    Tests if authentication works correctly.

    """

    send = host.run("echo 'Hello' | sendxmpp -t -u john.doe -p johnpassword -j domain1:5222 john.doe@domain1")

    assert send.rc == 0

    send = host.run("echo 'Hello' | sendxmpp -e -u john.doe -p johnpassword -j domain1:5223 john.doe@domain1")

    assert send.rc == 0

    send = host.run("echo 'Hello' | sendxmpp -t -u jane.doe -p janepassword -j domain2:5222 jane.doe@domain2")

    assert send.rc == 0

    send = host.run("echo 'Hello' | sendxmpp -e -u mick.doe -p mickpassword -j domain3:5223 mick.doe@domain3")

    assert send.rc == 0

def test_unauthorized_users_rejected(host):

    """

    Tests if unauthorized users (present in LDAP, but not member of correct

    group) are rejected from accessing the XMPP server.

    """

    send = host.run("echo 'Hello' | sendxmpp -t -u noxmpp -p noxmpppassword -j domain1:5222 john.doe@domain1")

    assert send.rc != 0

    assert "Error 'AuthSend': error: not-authorized[?]" in send.stderr

    '.molecule/ansible_inventory.yml').get_hosts(['parameters-mandatory', 'parameters-optional'])

def test_installed_packages(host):

    assert host.package('python-apt').is_installed

    assert host.package('lua-sec').is_installed

    assert host.package('lua-ldap').is_installed

    assert host.package('prosody').is_installed

def test_prosody_apt_key(host):

    keys = host.run("apt-key list")

def test_prosody_repository(host):

    repository = host.file("/etc/apt/sources.list.d/packages_prosody_im_debian.list")

def test_prosody_user(host):

    assert 'ssl-cert' in host.user('prosody').groups

def test_prosody_modules_directory(host):

    directory = host.file('/usr/local/lib/prosody/modules')

def test_prosody_mod_auth_ldap(host):

    module = host.file('/usr/local/lib/prosody/modules/mod_auth_ldap.lua')

def test_prosody_configuration_file(host):

    with host.sudo():

        config = host.file('/etc/prosody/prosody.cfg.lua')

def test_services(host):

    service = host.service('prosody')

def test_firewall_configuration_file(host):

    with host.sudo():

        config = host.file('/etc/ferm/conf.d/30-xmpp.conf')

    '.molecule/ansible_inventory.yml').get_hosts('parameters-mandatory')

def test_prosody_tls_files(host):

    hostname = host.run('hostname').stdout

    with host.sudo():

        tls_file = host.file('/etc/ssl/private/%s.domain1_xmpp.key' % hostname)

        assert tls_file.content == open("tests/data/x509/%s.domain1_xmpp.key" % hostname, "r").read().rstrip()

        tls_file = host.file('/etc/ssl/certs/%s.domain1_xmpp.pem' % hostname)

        assert tls_file.content == open("tests/data/x509/%s.domain1_xmpp.pem" % hostname, "r").read().rstrip()

def test_certificate_validity_check_configuration(host):

    hostname = host.run('hostname').stdout

    config = host.file('/etc/check_certificate/%s.domain1_xmpp.conf' % hostname)

    assert config.content == "/etc/ssl/certs/%s.domain1_xmpp.pem" % hostname

def test_prosody_configuration_file_content(host):

    hostname = host.run('hostname').stdout

    with host.sudo():

        config = host.file('/etc/prosody/prosody.cfg.lua')

        assert "key = \"/etc/ssl/private/%s.domain1_xmpp.key\";" % hostname in config.content

        assert "certificate = \"/etc/ssl/certs/%s.domain1_xmpp.pem\";" % hostname in config.content

    '.molecule/ansible_inventory.yml').get_hosts('parameters-optional')

def test_prosody_tls_files(host):

    hostname = host.run('hostname').stdout

    with host.sudo():

        tls_file = host.file('/etc/ssl/private/%s_xmpp.key' % hostname)

        tls_file = host.file('/etc/ssl/certs/%s_xmpp.pem' % hostname)