---
# yamllint disable rule:line-length
- name: Test tunnels to hosts not managed by Ansible
  hosts: all
  vars_files:
    - './vars/main.yml'
  vars:
    __vpn_num_hosts: 2
    __vpn_unmanaged_host: "{{ 'host0' + (__vpn_num_hosts + 1) | string + '.local' }}"
    __vpn_unmanaged_hostname: '169.254.1.1'
  tasks:
    - name: Set up test environment
      include_tasks: tasks/setup_test.yml

    - name: Add extra options and unmanaged host
      set_fact:
        __new_vpn_connections: "{{ __new_vpn_connections | d([]) + [new_tunnel] | list }}"
      loop: "{{ vpn_connections }}"
      vars:
        new_hosts: "{{ item.hosts |
          combine({__vpn_unmanaged_host: {'hostname': __vpn_unmanaged_hostname}}) }}"
        new_tunnel: "{{ item | combine({'hosts': new_hosts}) }}"

    - name: Reset vpn_connections
      set_fact:
        vpn_connections: "{{ __new_vpn_connections }}"

    - name: Use vpn role
      include_role:
        name: linux-system-roles.vpn
        public: true

    - name: Stat unmanaged host conf file path
      stat:
        path: '/etc/ipsec.d/{{ inventory_hostname }}-to-{{ __vpn_unmanaged_host }}.conf'
      register: unmanagedconf

    - name: Assert existence of unmanaged host conf file
      assert:
        that:
          - unmanagedconf.stat.exists

    - name: Stat unmanaged host secrets file path
      stat:
        path: "/etc/ipsec.d/{{ inventory_hostname }}-to-{{ __vpn_unmanaged_host }}.secrets"
      register: unmanagedsecrets

    - name: Assert existence of unmanaged host secrets file
      assert:
        that:
          - unmanagedsecrets.stat.exists

    - name: Reset success flag
      set_fact:
        __vpn_success: true

    - name: Get and store conf file for unmanaged host
      slurp:
        src: "/etc/ipsec.d/{{ inventory_hostname }}-to-{{ __vpn_unmanaged_host }}.conf"
      register: __vpn_register_unmanaged_conf

    - name: Check that unmanaged host conf file contains correct information
      set_fact:
        __vpn_success: false
      when: >-
        __vpn_register_unmanaged_conf.content | b64decode is not
        search('left=' + __vpn_main_hostname) or
        __vpn_register_unmanaged_conf.content | b64decode is not
        search('leftid=@' + __vpn_main_hostname) or
        __vpn_register_unmanaged_conf.content | b64decode is not
        search('right=' + __vpn_unmanaged_hostname) or
        __vpn_register_unmanaged_conf.content | b64decode is not
        search('rightid=' + __vpn_unmanaged_hostname)

    - name: Assert success for unmanaged host conf file
      assert:
        that: __vpn_success | d(false)
        msg: Found errors in .conf file for unmanaged host

    - name: Get and store unmanaged host secrets files
      slurp:
        src: "/etc/ipsec.d/{{ inventory_hostname }}-to-{{ __vpn_unmanaged_host }}.secrets"
      register: __vpn_register_unmanaged_secrets

    - name: Check that secrets file contains correct information
      set_fact:
        __vpn_success: false
      when: >-
        __vpn_register_unmanaged_secrets.content | b64decode |
        regex_search('^@' + __vpn_main_hostname + ' ' +
        __vpn_unmanaged_hostname + ' : PSK *',
        multiline=True) | d() | length == 0

    - name: Assert success for unmanaged host secrets files
      assert:
        that: __vpn_success | d(false)
        msg: Found errors in .secrets file for unmanaged host

    - name: Check the firewall and the selinux port status
      include_tasks: tasks/check_firewall_selinux.yml

    - name: Cleanup
      include_tasks: tasks/cleanup.yml
      tags:
        - tests::cleanup
