# SPDX-License-Identifier: MIT
---

# To run this test properly AD (ad1) needs to be present in the inventory
# AD should be pre-configured as a dns for the client machine.
# AD's DNS service should be configured with both forward and reverse zones
# and the DNS records from any previous runs removed.

# Example inventory:
# [client]
# client1 ansible_connection=local ansible_host=127.0.0.1 \
#  ad_integration_join_to_dc="ad1.domain.com" \
#  ad_integration_password=Secret123 ad_integration_realm="domain.com" \
#  ad_dyndns_update=true
# [ad]
# ad1 ansible_host=<AD IP> ansible_connection=winrm ansible_password=Secret123\
#  ansible_port=5986 ansible_user=Administrator \
#  ansible_winrm_server_cert_validation=ignore

- name: Ensure that the role configures dynamic dns
  hosts: all,!ad
  gather_facts: true
  vars:
    # if we don't have a real AD server, just verify the config
    # file is written properly
    __ad_integration_test_sssd_config_only: "{{
      ansible_play_hosts_all | length == 1 }}"
    # note - value from inventory such as described above
    # will override this value
    ad_integration_realm: dyndns-sample-realm.com
  tasks:
    - name: Run test
      block:
        - name: Setup fake realm
          include_tasks: tasks/manage_fake_realm.yml
          vars:
            __manage_fake_realm: setup
          when: __ad_integration_test_sssd_config_only

        - name: Test - Run the system role with bogus vars
          include_role:
            name: linux-system-roles.ad_integration
            public: true
          vars:
            ad_dyndns_iface: TESTING
            ad_dyndns_server: 127.0.0.1
            ad_dyndns_auth: GSS-TSIG
            ad_dyndns_update: true

        - name: Check custom dyndns settings
          community.general.ini_file:
            path: "{{ __ad_integration_sssd_conf }}"
            state: present
            section: domain/{{ ad_integration_realm }}
            option: "{{ item.key }}"
            value: "{{ item.value }}"
            create: true
            owner: root
            group: root
            mode: u=rw,g=,o=
          loop:
            - key: dyndns_update
              value: "True"
            - key: dyndns_iface
              value: TESTING
            - key: dyndns_auth
              value: GSS-TSIG
            - key: dyndns_server
              value: 127.0.0.1
          register: __result
          failed_when: __result is changed

        - name: Search /var/log/sssd/sssd.log for [sss_ini_call_validators]
          command: grep -i sss_ini_call_validators /var/log/sssd/sssd.log
          register: sssd_log
          changed_when: false
          failed_when: false

        - name: Fail if signature found
          fail:
            msg: Appears to be an unsupported option in /etc/sssd/sssd.conf
          when: sssd_log.stdout | length > 0

        - name: Test - Re-run the system role to remove vars
          include_role:
            name: linux-system-roles.ad_integration
          vars:
            ad_dyndns_iface: null
            ad_dyndns_server: null
            ad_dyndns_update: true

        - name: Restart sssd
          service:
            name: sssd
            state: restarted
          when: not __ad_integration_test_sssd_config_only | d(false)

        - name: Check custom dyndns settings are removed
          community.general.ini_file:
            path: "{{ __ad_integration_sssd_conf }}"
            state: absent
            section: domain/{{ ad_integration_realm }}
            option: "{{ item.key }}"
            create: true
            owner: root
            group: root
            mode: u=rw,g=,o=
          loop:
            - key: dyndns_iface
              value: null
            - key: dyndns_server
              value: null
          register: __result
          failed_when: __result is changed

        - name: Test - Verify IPv4 DNS records were created
          when: not __ad_integration_test_sssd_config_only | d(false)
          block:
            - name: Gather facts
              setup:

            # I am executing dig via shell instead of using the dig lookup because
            # in my situation my ansible control host is on a different network and
            # DNS than the VMs I am testing against.
            - name: Get IP for host's FQDN
              command: dig +short {{ ansible_fqdn }} A
              register: dig_hostname
              changed_when: false
              failed_when: false

            - name: Get hostname for host's IP address
              command: dig +short -x {{ ansible_default_ipv4.address }} PTR
              register: dig_ip
              changed_when: false
              failed_when: false

            - name: Assert IPv4 DNS records were created
              assert:
                that:
                  - "'{{ dig_hostname.stdout }}' ==
                    '{{ ansible_default_ipv4.address }}'"
                  - "'{{ dig_ip.stdout }}' == '{{ ansible_fqdn }}.'"
              when: ansible_default_ipv4.address is defined

      always:
        - name: Cleanup fake realm
          include_tasks: tasks/manage_fake_realm.yml
          vars:
            __manage_fake_realm: cleanup
          when: __ad_integration_test_sssd_config_only
