# SPDX-License-Identifier: MIT
---
# Assume firewalld and selinux are not manually configured.
- name: Check firewall
  when:
    - metrics_provider == 'pcp'
    - ansible_facts['os_family'] == 'RedHat'
    - ansible_facts['distribution_version'] is version('7', '>=')
    - metrics_manage_firewall | bool
  block:
    - name: "Check firewall service status for grafana;
             metrics_manage_firewall is true"
      command: firewall-offline-cmd --list-services
      register: _result
      failed_when:
        - "'grafana' not in _result.stdout"
      changed_when: false
      when:
        - metrics_graph_service|d(false)|bool

    # NOTE: not all versions of firewall have a "valkey" service yet
    # so for now, we are using the port - see below
    # - name: "Check firewall service status for valkey;
    #          metrics_manage_firewall is true"
    #   command: firewall-offline-cmd --list-services
    #   register: _result
    #   failed_when: "'valkey' not in _result.stdout"
    #   changed_when: false
    #   when:
    #     - metrics_query_service | d(false) | bool
    #     - ansible_distribution not in ['RedHat', 'CentOS'] or
    #       (ansible_distribution in ['RedHat', 'CentOS'] and
    #       ansible_distribution_major_version | int >= 10)

    - name: "Check firewall service status for redis;
             metrics_manage_firewall is true"
      command: firewall-offline-cmd --list-services
      register: _result
      failed_when: "'redis' not in _result.stdout"
      changed_when: false
      when:
        - metrics_query_service|d(false)|bool
        - ansible_distribution in ['RedHat', 'CentOS']
        - ansible_distribution_major_version | int > 6
        - ansible_distribution_major_version | int < 10

    - name: "Check firewall port status for pmproxy;
             metrics_manage_firewall is true"
      command: firewall-offline-cmd --list-ports
      register: _result
      failed_when:
        - "'44322/tcp' not in _result.stdout"
      changed_when: false
      when:
        - metrics_graph_service|d(false)|bool or
          metrics_query_service|d(false)|bool

    - name: "Check firewall port status for pmcd;
             metrics_manage_firewall is true"
      command: firewall-offline-cmd --list-ports
      register: _result
      failed_when: "'44321/tcp' not in _result.stdout"
      changed_when: false

    - name: "Check firewall port status for valkey;
             metrics_manage_firewall is true"
      command: firewall-offline-cmd --list-ports
      register: _result
      failed_when: "'6379/tcp' not in _result.stdout"
      changed_when: false
      when:
        - metrics_query_service | d(false) | bool
        - ansible_distribution not in ['RedHat', 'CentOS'] or
          (ansible_distribution in ['RedHat', 'CentOS'] and
          ansible_distribution_major_version | int >= 10)

- name: Check associated selinux ports (metrics_manage_selinux is true)
  shell: |-
    set -euo pipefail
    semanage boolean --list | egrep "pcp_bind_all_unreserved_ports *\(on "
  changed_when: false
  when: metrics_manage_selinux | bool
