---
- name: Test second sshd service
  hosts: all
  vars:
    __sshd_test_backup_files:
      - /etc/ssh/sshd_config
      - /etc/ssh/sshd_config.d/00-ansible_system_role.conf
      - /etc/systemd/system/sshd.service
      - /etc/systemd/system/sshd@.service
      - /etc/systemd/system/sshd.socket
      - /etc/systemd/system/ssh.service
      - /etc/systemd/system/ssh@.service
      - /etc/systemd/system/ssh.socket
    __sshd_test_remove_files:
      - /etc/ssh2
      - /etc/systemd/system/sshd2.service
      - /etc/systemd/system/sshd2@.service
      - /etc/systemd/system/sshd2.socket
  tasks:
    - name: "Backup configuration files"
      ansible.builtin.include_tasks: tasks/backup.yml

    - name: Create ssh2 directory
      ansible.builtin.file:
        path: /etc/ssh2
        state: directory
        mode: '0755'

    - name: Configure alternative sshd_config file
      ansible.builtin.include_role:
        name: ansible-sshd
      vars:
        sshd_service: sshd2
        sshd_config_file: /etc/ssh2/sshd_config
        sshd_install_service: true
        sshd_manage_selinux: true
        sshd:
          Port: 2222
          ForceCommand: echo "CONNECTED2"

    - name: Verify the config options are correctly set
      tags: tests::verify
      block:
        - name: Flush handlers
          ansible.builtin.meta: flush_handlers

        - name: Stat the parent directory
          ansible.builtin.stat:
            path: /etc/ssh2
          register: parent_stat

        - name: Print configuration file
          ansible.builtin.slurp:
            src: /etc/ssh2/sshd_config
          register: config

        - name: Check content of the created configuration file
          ansible.builtin.assert:
            that:
              - "'Port 2222' in config.content | b64decode"
              - "'ForceCommand echo' in config.content | b64decode"

        - name: Check the parent directory has not changed to drop-in directory permissions
          ansible.builtin.assert:
            that:
              - parent_stat.stat.exists
              - parent_stat.stat.mode == '0755'

    - name: Verify the service files are correct
      tags: tests::verify
      when:
        - ansible_facts['service_mgr'] == 'systemd' or
          (ansible_facts['os_family'] == 'RedHat' and ansible_facts['distribution_major_version'] == '7')
      block:
        - name: Read the created service file
          ansible.builtin.slurp:
            src: "/etc/systemd/system/sshd2.service"
          register: service

        - name: Read the created socket file
          ansible.builtin.slurp:
            src: "/etc/systemd/system/sshd2.socket"
          register: socket

        - name: Check content of the created service file
          ansible.builtin.assert:
            that:
              - "' -f/etc/ssh/sshd_config' not in service.content | b64decode"
              - "' -f/etc/ssh2/sshd_config' in service.content | b64decode"

    - name: Verify the instantiated service file is correct
      tags: tests::verify
      when:
        - ansible_facts['service_mgr'] == 'systemd' or
          (ansible_facts['os_family'] == 'RedHat' and ansible_facts['distribution_major_version'] == '7')
        - ansible_facts['distribution'] != "Debian" or ansible_facts['distribution_major_version'] | int < 12
        - not (ansible_facts['distribution'] == 'Ubuntu' and ansible_facts['distribution_version'] is version('24.04', '>='))
      block:
        - name: Read the created instantiated service file
          ansible.builtin.slurp:
            src: "/etc/systemd/system/sshd2@.service"
          register: service_inst

        - name: Check content of the created service file
          ansible.builtin.assert:
            that:
              - "' -f/etc/ssh/sshd_config' not in service_inst.content | b64decode"
              - "' -f/etc/ssh2/sshd_config' in service_inst.content | b64decode"

    - name: Stop second service
      ansible.builtin.service:
        name: sshd2
        state: stopped
        enabled: false
      ignore_errors: true  # noqa ignore-errors

    - name: Remove second service
      ansible.builtin.file:
        path: "{{ item }}"
        state: absent
      loop: "{{ __sshd_test_remove_files }}"

    - name: Refresh systemd
      # noqa command-instead-of-module
      ansible.builtin.shell: systemctl reset-failed; systemctl daemon-reload
      when: ansible_facts["service_mgr"] == "systemd"
      changed_when: true
      ignore_errors: true  # noqa ignore-errors

    - name: "Restore configuration files"
      ansible.builtin.include_tasks: tasks/restore.yml