---
- name: Ensure role handles startup issues
  hosts: all
  gather_facts: false
  tasks:
    - name: Attempt to run role with default parameters (1)
      include_role:
        name: linux-system-roles.firewall

    - name: Mask firewalld
      systemd:
        name: firewalld
        masked: true

    - name: Attempt to run role with default parameters (2)
      include_role:
        name: linux-system-roles.firewall

    - name: Determine if system is ostree and set flag
      when: not __firewall_is_ostree is defined
      block:
        - name: Check if system is ostree
          stat:
            path: /run/ostree-booted
          register: __ostree_booted_stat

        - name: Set flag to indicate system is ostree
          set_fact:
            __firewall_is_ostree: "{{ __ostree_booted_stat.stat.exists }}"

    - name: Install conflicting service
      package:
        name: nftables
        state: present
        use: "{{ (__firewall_is_ostree | d(false)) |
                ternary('ansible.posix.rhel_rpm_ostree', omit) }}"

    - name: Enable conflicting service
      service:
        name: nftables
        enabled: true

    - name: Attempt to run role, disabling conflicting services
      include_role:
        name: linux-system-roles.firewall
      vars:
        firewall_disable_conflicting_services: true

    - name: Check that conflicting service is disabled
      service:
        name: nftables
        enabled: false
      check_mode: true
      register: result
      failed_when: result.changed
