---
# Full-integration Molecule scenario for the perforce-sdp-install role.
#
# Brings up a real (unlicensed) p4d inside a systemd-enabled container on both
# Debian (Ubuntu) and RedHat/EL (Rocky) families, configures it with
# configure_new_server.sh, and runs the SDP functional test harness.
#
# Requires Docker with systemd-capable images (the geerlingguy *-ansible images
# run systemd as PID 1). The containers are privileged with the host cgroup
# mounted so systemctl can manage the p4d_1 service.
#
# Run:   molecule test                  # full create/converge/verify/destroy
#        molecule converge              # bring up p4d + configure
#        molecule verify                # assertions + SDP test harness
#        MOLECULE_NO_DESTROY=1 molecule converge   # keep the container for poking

dependency:
  name: galaxy

driver:
  name: docker

platforms:
  - name: sdp-ubuntu2204
    image: geerlingguy/docker-ubuntu2204-ansible:latest
    command: ${MOLECULE_DOCKER_COMMAND:-""}
    privileged: true
    cgroupns_mode: host
    volumes:
      - /sys/fs/cgroup:/sys/fs/cgroup:rw
    pre_build_image: true
    groups:
      - main

  - name: sdp-rocky9
    image: geerlingguy/docker-rockylinux9-ansible:latest
    command: ${MOLECULE_DOCKER_COMMAND:-""}
    privileged: true
    cgroupns_mode: host
    volumes:
      - /sys/fs/cgroup:/sys/fs/cgroup:rw
    pre_build_image: true
    groups:
      - main

provisioner:
  name: ansible
  config_options:
    defaults:
      # The role relies on facts (os_family, distribution_major_version, etc.).
      gathering: smart
      # SDP scripts and p4d are noisy; keep output readable. (community.general's
      # 'yaml' callback was removed; use the built-in default with YAML format.)
      stdout_callback: ansible.builtin.default
      result_format: yaml
  inventory:
    group_vars:
      all:
        # The geerlingguy images run as root. Declaring the connection user as
        # root lets Ansible skip 'become' for become_user: root tasks
        # (become_allow_same_user defaults to false), so the role does not depend
        # on a working sudo/PAM stack inside the container.
        ansible_user: root
        # Use su for root->non-root become (become_user: perforce). The
        # geerlingguy EL9 image's sudo PAM stack fails in-container; su
        # (root -> any user, no password) works. Real hosts use sudo.
        ansible_become_method: ansible.builtin.su
        # --- flow control: full fresh install, no broker/license for the test ---
        perforce_clean: false
        # main-playbook.yml sets this as a play var; the role references it bare
        # (sdp_upgrade), so provide it here when running the role standalone.
        update_perforce: false
        update_dependencies: true
        new_sdp: true
        new_p4d: false
        p4d_enabled: true
        install_broker: false
        copy_license: false
        dummy_interface: false
        perforce_depots_use_nfs: false
        # Map the configured DNS names to this container in /etc/hosts so the
        # master-targeting scripts and the harness can connect to themselves.
        manage_etc_hosts: true

        # --- identity / topology (single commit-server) ---
        perforce_id: "1"
        perforce_server_type: "p4d_master"
        perforce_master_id: "master"
        perforce_replica_id: "standby"
        p4serviceuser: "svc_master"
        perforce_dnsname: "{{ inventory_hostname }}"
        perforce_standby_dnsname: "{{ inventory_hostname }}-standby"
        commit_dns: "{{ inventory_hostname }}"
        target_server: "{{ commit_dns }}"

        # --- ports / server config ---
        perforce_case_sensitive: "0"
        perforce_service: "p4d_{{ perforce_id }}"
        perforce_ssl_prefix: ""
        perforce_p4_port: "1666"
        perforce_p4broker_port: "ssl:1667"
        perforce_p4broker_target_port: "1666"

        # --- OS user / group ---
        perforce_user: "perforce"
        perforce_uid: "10666"
        perforce_group: "perforce"
        perforce_gid: "10666"

        # --- binary versions (downloaded from ftp.perforce.com) ---
        perforce_version: "25.2"
        perforce_broker_version: "25.2"

        # --- volume path *fragments* (no leading slash; prepare.yml creates them) ---
        perforce_data_volume: "hxdepots"
        perforce_common_volume: "hxdepots"
        perforce_log_volume: "hxlogs"
        perforce_online_metadata_volume: "hxmetadata"
        perforce_offline_metadata_volume: "hxmetadata"

        # --- mail / domain (template values only) ---
        perforce_domain: "molecule.test"
        perforce_mailfrom_email: "perforce-admin@{{ perforce_domain }}"
        perforce_mailto_email: "perforce-admin@{{ perforce_domain }}"
        perforce_smtp_server: "smtp.{{ perforce_domain }}"

        # --- admin / passwords (test-only; never used in production) ---
        perforce_admin_user: "p4admin"
        perforce_admin_user_pass: "F@stSCM!"
        admin_users: []
        # perforce_user_password (a SHA-512 crypt hash) is defined in
        # molecule/default/group_vars/all.yml -- its leading dollar-sign
        # sequences cannot live here because Molecule interpolates this file.

verifier:
  name: ansible

scenario:
  # The role (and the converge's configure step) are guarded to be idempotent, so
  # the idempotence step re-runs converge and asserts zero changes.
  test_sequence:
    - dependency
    - destroy
    - syntax
    - create
    - prepare
    - converge
    - idempotence
    - verify
    - destroy