---

- name: Prepare, test fixtures

  hosts: localhost

  connection: local

  gather_facts: false

  tasks:

    - name: Initialise CA hierarchy

      ansible.builtin.command: "gimmecert init --ca-hierarchy-depth 2"

      args:

        creates: ".gimmecert/ca/level1.cert.pem"

        chdir: "tests/data/"

    - name: Set-up link to generated X.509 material

      ansible.builtin.file:

        src: ".gimmecert"

        dest: "tests/data/x509"

        state: link

- name: Prepare

  hosts: all

  become: true

  gather_facts: false

  tasks:

    - name: Install python for Ansible

      ansible.builtin.raw: test -e /usr/bin/python3 || (apt -y update && apt install -y python3-minimal)

      changed_when: false

    - name: Update all caches to avoid errors due to missing remote archives

      ansible.builtin.apt:

        update_cache: true

      changed_when: false

    - name: Install net-tools for running Testinfra host.socket tests

      ansible.builtin.apt:

        name: net-tools

        state: present

- name: Prepare, helpers

  hosts: helper

  become: true

  tasks:

    - name: Install apt-cacher-ng

      ansible.builtin.apt:

        name: apt-cacher-ng

        state: present

- name: Prepare, helpers

  hosts: client

  become: true

  tasks:

    - name: Install tool for testing TCP connectivity

      ansible.builtin.apt:

        name: nmap

        state: present

    - name: Set-up /etc/hosts with entries for all servers

      ansible.builtin.lineinfile:

        path: /etc/hosts

        regexp: "^{{ item.key }}"

        line: "{{ item.key }} {{ item.value }}"

        owner: root

        group: root

        mode: "0644"

        state: present

      with_dict:

        192.168.56.21: parameters-mandatory-bookworm

        192.168.56.22: parameters-optional-bookworm

        fd00::192:168:56:21: parameters-mandatory-bookworm

        fd00::192:168:56:22: parameters-optional-bookworm

- name: Prepare, test fixtures

  hosts: parameters-mandatory,parameters-optional

  become: true

  tasks:

    - name: Set-up /etc/hosts with entries for all servers

      ansible.builtin.lineinfile:

        path: /etc/hosts

        regexp: "^{{ item.key }}"

        line: "{{ item.key }} {{ item.value }}"

        owner: root

        group: root

        mode: "0644"

        creates: ".gimmecert/ca/level1.cert.pem"

        chdir: "tests/data/"

    - name: Generate server private keys and certificates

      ansible.builtin.command:

      args:

        chdir: "tests/data/"

        creates: ".gimmecert/server/{{ item.name }}.cert.pem"

        argv:

          - "gimmecert"

          - "server"

          - "{{ item.name }}"

          - "{{ item.fqdn }}"

      with_items:

        - name: parameters-mandatory-bookworm_ldap

          fqdn: parameters-mandatory

        - name: parameters-optional-bookworm_ldap

          fqdn: parameters-optional

    - name: Set-up link to generated X.509 material

      ansible.builtin.file:

        src: ".gimmecert"

        dest: "tests/data/x509"

        state: link

- name: Prepare

  hosts: all

  become: true

  gather_facts: false

  tasks:

    - name: Install python for Ansible

      ansible.builtin.raw: test -e /usr/bin/python3 || (apt -y update && apt install -y python3-minimal)

      changed_when: false

    - name: Update all caches to avoid errors due to missing remote archives

      ansible.builtin.apt:

        update_cache: true

      changed_when: false

    - name: Deploy CA certificate

      ansible.builtin.copy:

        src: tests/data/x509/ca/level1.cert.pem

        dest: /etc/ssl/certs/testca.cert.pem

        owner: root

        group: root

        mode: "0644"

    - name: Install tools for testing

      ansible.builtin.apt:

        name:

          - net-tools

          - nmap

          - gnutls-bin

        state: present

- name: Prepare, helpers

  hosts: client

  become: true

  tasks:

    - name: Install tool for teting TCP connectivity

      ansible.builtin.apt:

        name: hping3

        state: present

    - name: Set-up /etc/hosts with entries for all servers

      ansible.builtin.lineinfile:

        path: /etc/hosts

        regexp: "^{{ item.key }}"

        line: "{{ item.key }} {{ item.value }}"

        owner: root

        group: root

        mode: "0644"

        state: present

      with_dict:

        192.168.56.21: parameters-mandatory-bookworm

        192.168.56.22: parameters-optional-bookworm

- name: Prepare, test fixtures

  hosts: parameters-optional

  become: true

  tasks:

    - name: Set-up the hosts file

      ansible.builtin.lineinfile:

        path: /etc/hosts

        regexp: "^{{ item.key }}"

        line: "{{ item.key }} {{ item.value }}"

        owner: root

        group: root

        mode: "0644"

        state: present

      with_dict:

        127.0.2.1: parameters-optional

    - name: Initialise CA hierarchy

      ansible.builtin.command: "gimmecert init"

      args:

        creates: ".gimmecert/ca/level1.cert.pem"

        chdir: "tests/data/"

    - name: Generate server private keys and certificates

      ansible.builtin.command:

      args:

        chdir: "tests/data/"

        creates: ".gimmecert/server/{{ item.name }}.cert.pem"

        argv:

          - "gimmecert"

          - "server"

          - "{{ item.name }}"

          - "{{ item.fqdn }}"

      with_items:

        - name: parameters-mandatory_https

          fqdn: parameters-mandatory

        - name: parameters-optional.local_https

          fqdn: parameters-optional.local

        - name: parameters-paste-req_https

          fqdn: parameters-paste-req

        - name: wsgi-website_https

          fqdn: wsgi-website

    - name: Set-up link to generated X.509 material

      ansible.builtin.file:

        src: ".gimmecert"

        dest: "tests/data/x509"

        state: link

- name: Prepare

  hosts: all

  become: true

  gather_facts: false

  tasks:

    - name: Install python for Ansible

      ansible.builtin.raw: test -e /usr/bin/python3 || (apt -y update && apt install -y python3-minimal)

      changed_when: false

    - name: Update all caches to avoid errors due to missing remote archives

      ansible.builtin.apt:

        update_cache: true

      changed_when: false

- name: Prepare, test fixtures

  hosts: wsgi-website

  become: true

  tasks:

    - name: Set-up /etc/hosts entries

      ansible.builtin.lineinfile:

        dest: /etc/hosts

        line: "{{ ansible_eth0.ipv4.address }} parameters-mandatory parameters-optional.local parameters-paste-req wsgi-website"

    - name: Install curl for testing redirects and webpage content

      ansible.builtin.apt:

        name: curl

        state: present

    - name: Install swaks for testing mail forwarding

      ansible.builtin.apt:

        name: swaks

        state: present

    - name: Install net-tools for testing sockets

      ansible.builtin.apt:

        name: net-tools

        state: present

    - name: Install Postfix for testing mail forwarding (Exim4 not covered)

      ansible.builtin.apt:

        name: postfix

        state: present

    - name: Install procmail for consistency with mail_server and mail_forwarder roles

      ansible.builtin.apt:

        name: procmail

        state: present

    - name: Update Postfix configuration

      ansible.builtin.lineinfile:

        path: /etc/postfix/main.cf

        regexp: "^{{ item.key }}"

        line: "{{ item.value }}"

        state: present

      with_dict:

        myhostname: "myhostname = {{ inventory_hostname }}"

        mailbox_command: 'mailbox_command = procmail -a "$EXTENSION"'

      notify:

        - Restart Postfix

    - name: Direct all mails from the root account to vagrant