---
- name: Render membership manifests without contacting a cluster
  hosts: localhost
  connection: local
  gather_facts: false
  vars:
    role_path: /roles/ansible-role-www
  tasks:
    - name: Load role defaults
      ansible.builtin.include_vars: ../defaults/main.yml
    - name: Supply nonsecret fixture settings
      ansible.builtin.set_fact:
        www_membership_image: registry.example.org/www-membership:release-test
        www_membership_service_groups:
          "0": ["cn=free-service,ou=groups,dc=example,dc=org"]
          "2": ["cn=paid-service,ou=groups,dc=example,dc=org", "cn=second-service,ou=groups,dc=example,dc=org"]
        _www_membership_revision: aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
        www_membership_environment: "{{ www_membership_environment | combine({'MEMBERSHIP_PUBLIC_URL': 'https://' ~ www_hostname, 'LDAP_BIND_DN': 'cn=membership,dc=example,dc=org', 'LDAP_PASSWORD_SCHEME': '{ARGON2}', 'EMAIL_HOST': 'smtp.example.org', 'STRIPE_PORTAL_CONFIGURATION': 'bpc_test'}) }}"
    - name: Render Apache proxy fixture
      ansible.builtin.set_fact:
        _www_proxy_config: "{{ lookup('ansible.builtin.template', role_path ~ '/templates/membership-httpd.conf.j2') }}"
    - name: Write Apache fixture for container syntax tests
      ansible.builtin.template:
        src: ../templates/membership-httpd.conf.j2
        dest: /tmp/www-test-membership.conf
        mode: "0600"
    - name: Render standard deployment variants
      ansible.builtin.template:
        src: "../templates/{{ item }}.yml.j2"
        dest: "/tmp/www-test-{{ item }}.yml"
        mode: "0600"
      loop: [website, membership-config, membership-postgres, membership-migrate, membership-workloads]
    - name: Enable explicit plaintext LDAP fixture
      ansible.builtin.set_fact:
        www_membership_environment: "{{ www_membership_environment | combine({'LDAP_URL': 'ldap://openldap.openldap.svc.cluster.local:389', 'LDAP_ALLOW_INSECURE': '1'}) }}"
    - name: Render plaintext LDAP configuration
      ansible.builtin.template:
        src: ../templates/membership-config.yml.j2
        dest: /tmp/www-test-plaintext-membership-config.yml
        mode: "0600"
    - name: Enable optional external database and private CA fixture
      ansible.builtin.set_fact:
        www_membership_postgres_managed: false
        www_membership_ca_secret_name: private-ca
        www_image_pull_secrets: [{name: registry-pull}]
        www_membership_environment: "{{ www_membership_environment | combine({'LDAP_URL': 'ldaps://ldap.example.com', 'LDAP_ALLOW_INSECURE': '0', 'POSTGRES_HOST': 'postgres.example.org', 'POSTGRES_SSLMODE': 'verify-full', 'PGSSLROOTCERT': '/etc/membership/ca/db.pem', 'LDAP_CA_CERT_FILE': '/etc/membership/ca/ldap.pem', 'SHKEEPER_URL': 'https://crypto.example.org', 'SHKEEPER_CURRENCIES': 'BTC,XMR', 'SHKEEPER_CA_CERT_FILE': '/etc/membership/ca/shkeeper.pem'}) }}"
    - name: Render external provider variants
      ansible.builtin.template:
        src: "../templates/{{ item }}.yml.j2"
        dest: "/tmp/www-test-external-{{ item }}.yml"
        mode: "0600"
      loop: [membership-config, membership-workloads, membership-migrate]
    - name: Render disabled membership proxy variant
      ansible.builtin.set_fact:
        www_membership_enabled: false
        www_onion_enabled: false
    - name: Render disabled Apache fixture
      ansible.builtin.set_fact:
        _www_proxy_config: "{{ lookup('ansible.builtin.template', role_path ~ '/templates/membership-httpd.conf.j2') }}"
    - name: Render disabled website
      ansible.builtin.template:
        src: ../templates/website.yml.j2
        dest: /tmp/www-test-disabled-website.yml
        mode: "0600"