Missing logic

.github/workflows/build.yml

@@ -13,9 +13,9 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
       - name: Run ansible-lint
-        uses: ansible/ansible-lint@v25
+        uses: ansible/ansible-lint@v26
         with:
           requirements_file: requirements.yml
 
@@ -40,7 +40,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           path: "${{ github.repository }}"
       - name: Molecule
@@ -52,6 +52,6 @@ jobs:
     needs: [lint, sanity, molecule]
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
       - name: Build collection
         uses: ansible-community/github-action-build-collection@main

.github/workflows/publish.yml

@@ -11,7 +11,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
       - name: Build collection
         id: build-collection
         uses: ansible-community/github-action-build-collection@main

CHANGELOG.md

@@ -1,3 +1,14 @@
+# 2.8.0
+
+[#45 Missing logic](https://github.com/Scalified/ansible-setup-collection/issues/45)
+
+* System: locales
+* System: scripts
+* System: services
+* j2 extensions for template files
+* SSL clients certificates generation
+* Docker: QEMU emulation, tcp host
+
 # 2.7.7
 
 [#44 Skip Age tasks on empty age private key file](https://github.com/Scalified/ansible-setup-collection/issues/44)

CLAUDE.md

@@ -52,9 +52,9 @@ This is an **Ansible Collection** for server setup automation, published as: `sc
 ## Molecule Tests
 
 * Run integration tests with: molecule test.
-* Every file with logic must have a corresponding test file in: `extensions/molecule/default/roles/<role>/tasks/`
-* Role-level verifications are placed in: `extensions/molecule/default/verify.yml`
+* Every file with logic must have a corresponding test file in: `molecule/default/roles/<role>/tasks/`
+* Role-level verifications are placed in: `molecule/default/verify.yml`
 * Use the following test files as templates:
-    * `extensions/molecule/default/packages/tasks/packages.yml` — verify package installations.
-    * `extensions/molecule/default/fs/tasks/mount.yml` — verify files, directories, scripts attributes and content.
-    * `extensions/molecule/default/docker/tasks/setup.yml` - verify user group.
+    * `molecule/default/packages/tasks/packages.yml` — verify package installations.
+    * `molecule/default/fs/tasks/mount.yml` — verify files, directories, scripts attributes and content.
+    * `molecule/default/docker/tasks/setup.yml` - verify user group.

galaxy.yml

@@ -1,6 +1,6 @@
 namespace: scalified
 name: setup
-version: 2.7.7
+version: 2.8.0
 readme: README.md
 authors:
   - Vladyslav Baidak <vld.x@hotmail.com>

molecule/default/group_vars/all.yml

@@ -1,6 +1,12 @@
 # System
 system_os_family: "{{ ansible_os_family | lower }}"
 
+system_locale_default: "en_US.UTF-8"
+system_locales:
+  - "en_GB.UTF-8"
+system_scripts:
+  - roles/system/files/system-test-script
+
 system_motd_contacts:
   - name: "John Doe"
     position: "System Administrator"
@@ -71,16 +77,51 @@ mail_recipient: "test@example.com"
 # SSL
 ssl_domain: "test.example.com"
 ssl_keys_ca_name: "ca.key"
+ssl_keys_server_dir: >-
+  {{
+    {
+      'debian': '/etc/ssl/private',
+      'redhat': '/etc/pki/tls/private'
+    }[system_os_family]
+  }}
 ssl_keys_server_name: "server.key"
+ssl_keys_server_path: "{{ ssl_keys_server_dir }}/{{ ssl_keys_server_name }}"
 ssl_certs_server_generate: true
+ssl_certs_ca_dir: >-
+  {{
+    {
+      'debian': '/usr/local/share/ca-certificates',
+      'redhat': '/etc/pki/ca-trust/source/anchors'
+    }[system_os_family]
+  }}
 ssl_certs_ca_name: "ca.crt"
+ssl_certs_ca_path: "{{ ssl_certs_ca_dir }}/{{ ssl_certs_ca_name }}"
+ssl_certs_server_dir: >-
+  {{
+    {
+      'debian': '/etc/ssl/certs',
+      'redhat': '/etc/pki/tls/certs'
+    }[system_os_family]
+  }}
 ssl_certs_server_name: "server.crt"
+ssl_certs_server_path: "{{ ssl_certs_server_dir }}/{{ ssl_certs_server_name }}"
 ssl_bundle_generate: true
 ssl_bundle_name: "bundle.crt"
+ssl_clients:
+  - name: docker
+    common_name: pc-workstation
+    extensions:
+      - clientAuth
+      - emailProtection
 
 # Docker
 docker_user: "{{ ansible_user_id }}"
+docker_systemd_override_dir: "/etc/systemd/system/docker.service.d"
 docker_system_prune_cron: ""
+docker_tls_enabled: true
+docker_tls_ca_path: "{{ ssl_certs_ca_path }}"
+docker_tls_key_path: "{{ ssl_keys_server_path }}"
+docker_tls_cert_path: "{{ ssl_certs_server_path }}"
 
 # Samba
 samba_interfaces:

molecule/default/roles/docker/tasks/setup.yml

@@ -32,3 +32,65 @@
         that: docker_user in docker_user_groups.stdout.split()
         fail_msg: "{{ docker_user }} user is not in the docker group"
         success_msg: "{{ docker_user }} user is in the docker group"
+
+- name: Verify Docker systemd override configuration
+  block:
+    - name: Stat Docker systemd override file
+      ansible.builtin.stat:
+        path: "{{ docker_systemd_override_dir }}/override.conf"
+      register: docker_systemd_override_stat
+
+    - name: Assert Docker systemd override file exists
+      ansible.builtin.assert:
+        that:
+          - docker_systemd_override_stat.stat.exists
+          - docker_systemd_override_stat.stat.isreg
+          - docker_systemd_override_stat.stat.mode == '0644'
+        fail_msg: "Docker systemd override file is missing or has incorrect attributes"
+        success_msg: "Docker systemd override file exists with correct attributes"
+
+    - name: Read Docker systemd override file
+      ansible.builtin.slurp:
+        src: "{{ docker_systemd_override_dir }}/override.conf"
+      register: docker_systemd_override_content
+
+    - name: Assert Docker systemd override file contains expected directives
+      ansible.builtin.assert:
+        that:
+          - "'ExecStart=' in (docker_systemd_override_content.content | b64decode)"
+          - "'--config-file=/etc/docker/daemon.json' in (docker_systemd_override_content.content | b64decode)"
+        fail_msg: "Docker systemd override file content does not match expected configuration"
+        success_msg: "Docker systemd override file contains expected directives"
+
+- name: Verify Docker daemon TLS configuration
+  block:
+    - name: Stat Docker daemon configuration file
+      ansible.builtin.stat:
+        path: /etc/docker/daemon.json
+      register: docker_daemon_json_stat
+
+    - name: Assert Docker daemon configuration file exists
+      ansible.builtin.assert:
+        that:
+          - docker_daemon_json_stat.stat.exists
+          - docker_daemon_json_stat.stat.isreg
+          - docker_daemon_json_stat.stat.mode == '0644'
+        fail_msg: "Docker daemon configuration file is missing or has incorrect attributes"
+        success_msg: "Docker daemon configuration file exists with correct attributes"
+
+    - name: Read Docker daemon configuration file
+      ansible.builtin.slurp:
+        src: /etc/docker/daemon.json
+      register: docker_daemon_json_content
+
+    - name: Assert Docker daemon TLS options are configured
+      ansible.builtin.assert:
+        that:
+          - daemon_json.tlsverify | bool
+          - daemon_json.tlscacert == docker_tls_ca_path
+          - daemon_json.tlskey == docker_tls_key_path
+          - daemon_json.tlscert == docker_tls_cert_path
+        fail_msg: "Docker daemon TLS configuration is missing or incorrect"
+        success_msg: "Docker daemon TLS configuration is valid"
+      vars:
+        daemon_json: "{{ docker_daemon_json_content.content | b64decode | from_json }}"

molecule/default/roles/packages/tasks/bash.yml

@@ -115,6 +115,23 @@
       loop_control:
         loop_var: alias
 
+    - name: Assert user-defined aliases separated by blank line
+      ansible.builtin.assert:
+        that:
+          - >-
+            "alias testls='ls -la'\n\n# Test alias for grep with line numbers"
+            in (packages_bash_aliases_content.content | b64decode)
+        fail_msg: "User-defined aliases are not separated by a blank line"
+        success_msg: "User-defined aliases are separated by a blank line"
+
+    - name: Assert .bash_aliases file is valid bash syntax
+      ansible.builtin.command:
+        argv:
+          - bash
+          - -n
+          - "{{ ansible_env.HOME }}/.bash_aliases"
+      changed_when: false
+
 - name: Verify .bashrc includes bash aliases
   block:
     - name: Stat .bashrc file exists

molecule/default/roles/ssl/defaults/main.yml

@@ -6,25 +6,18 @@ ssl_keys_ca_dir: >-
       'redhat': '/etc/pki/CA/private'
     }[system_os_family]
   }}
-ssl_keys_server_dir: >-
+ssl_keys_clients_dir: >-
   {{
     {
-      'debian': '/etc/ssl/private',
-      'redhat': '/etc/pki/tls/private'
-    }[system_os_family]
-  }}
-ssl_certs_ca_dir: >-
-  {{
-    {
-      'debian': '/usr/local/share/ca-certificates',
-      'redhat': '/etc/pki/ca-trust/source/anchors'
+      'debian': '/etc/ssl/private/clients',
+      'redhat': '/etc/pki/tls/private/clients'
     }[system_os_family]
   }}
-ssl_certs_server_dir: >-
+ssl_certs_clients_dir: >-
   {{
     {
-      'debian': '/etc/ssl/certs',
-      'redhat': '/etc/pki/tls/certs'
+      'debian': '/etc/ssl/certs/clients',
+      'redhat': '/etc/pki/tls/certs/clients'
     }[system_os_family]
   }}
 ssl_certs_ca_truststore_bundle: >-

molecule/default/roles/ssl/tasks/client.yml

@@ -0,0 +1,87 @@
+---
+- name: Stat SSL client private key file
+  ansible.builtin.stat:
+    path: "{{ ssl_keys_clients_dir }}/{{ client.name }}.key"
+  register: ssl_client_key_stat
+
+- name: Assert SSL client private key file exists and has correct attributes
+  ansible.builtin.assert:
+    that:
+      - ssl_client_key_stat.stat.exists
+      - ssl_client_key_stat.stat.isreg
+      - ssl_client_key_stat.stat.mode == '0600'
+      - ssl_client_key_stat.stat.pw_name == 'root'
+      - ssl_client_key_stat.stat.gr_name == 'root'
+    fail_msg: >-
+      SSL client private key file has incorrect attributes for '{{ client.name }}':
+      exists={{ ssl_client_key_stat.stat.exists }},
+      isreg={{ ssl_client_key_stat.stat.isreg }},
+      mode={{ ssl_client_key_stat.stat.mode }},
+      owner={{ ssl_client_key_stat.stat.pw_name }}:{{ ssl_client_key_stat.stat.gr_name }}
+    success_msg: "SSL client private key file has correct attributes for '{{ client.name }}'"
+
+- name: Stat SSL client certificate file
+  ansible.builtin.stat:
+    path: "{{ ssl_certs_clients_dir }}/{{ client.name }}.crt"
+  register: ssl_client_cert_stat
+
+- name: Assert SSL client certificate file exists and has correct attributes
+  ansible.builtin.assert:
+    that:
+      - ssl_client_cert_stat.stat.exists
+      - ssl_client_cert_stat.stat.isreg
+      - ssl_client_cert_stat.stat.mode == '0644'
+      - ssl_client_cert_stat.stat.pw_name == 'root'
+      - ssl_client_cert_stat.stat.gr_name == 'root'
+    fail_msg: >-
+      SSL client certificate file has incorrect attributes for '{{ client.name }}':
+      exists={{ ssl_client_cert_stat.stat.exists }},
+      isreg={{ ssl_client_cert_stat.stat.isreg }},
+      mode={{ ssl_client_cert_stat.stat.mode }},
+      owner={{ ssl_client_cert_stat.stat.pw_name }}:{{ ssl_client_cert_stat.stat.gr_name }}
+    success_msg: "SSL client certificate file has correct attributes for '{{ client.name }}'"
+
+- name: Get SSL client certificate information
+  ansible.builtin.command: openssl x509 -in "{{ ssl_certs_clients_dir }}/{{ client.name }}.crt" -text -noout
+  register: ssl_client_cert_info
+  changed_when: false
+
+- name: Assert SSL client certificate content
+  ansible.builtin.assert:
+    that:
+      - "ssl_client_cert_info.stdout is search('CN *= *' ~ (client.common_name | regex_escape))"
+      - "'CA:FALSE' in ssl_client_cert_info.stdout"
+      - "'TLS Web Client Authentication' in ssl_client_cert_info.stdout"
+    fail_msg: >-
+      SSL client certificate validation failed for '{{ client.name }}'
+    success_msg: "SSL client certificate is valid for '{{ client.name }}'"
+
+- name: Assert SSL client certificate has optional extended key usages
+  ansible.builtin.assert:
+    that: "optional_usage_mapped in ssl_client_cert_info.stdout"
+    fail_msg: "SSL client certificate does not have optional extended key usage '{{ optional_usage }}'"
+    success_msg: "SSL client certificate has optional extended key usage '{{ optional_usage }}'"
+  loop: "{{ client.extensions | default([]) | difference(['clientAuth']) }}"
+  loop_control:
+    loop_var: optional_usage
+  vars:
+    optional_usage_mapped: "{{ optional_usage | regex_replace('^emailProtection$', 'E-mail Protection') }}"
+  when: client.extensions | default([]) | difference(['clientAuth']) | length > 0
+
+- name: Check SSL client certificate validity
+  ansible.builtin.command: openssl x509 -in "{{ ssl_certs_clients_dir }}/{{ client.name }}.crt" -checkend 86400
+  register: ssl_client_cert_validity
+  changed_when: false
+  failed_when: ssl_client_cert_validity.rc != 0
+
+- name: Check SSL client certificate is signed by CA
+  ansible.builtin.command: >-
+    openssl verify -CAfile "{{ ssl_certs_ca_path }}" "{{ ssl_certs_clients_dir }}/{{ client.name }}.crt"
+  register: ssl_client_cert_chain
+  changed_when: false
+
+- name: Assert SSL client certificate chain is valid
+  ansible.builtin.assert:
+    that: "'OK' in ssl_client_cert_chain.stdout"
+    fail_msg: "SSL client certificate chain verification failed for '{{ client.name }}'"
+    success_msg: "SSL client certificate chain is valid for '{{ client.name }}'"

molecule/default/roles/ssl/tasks/main.yml

@@ -10,3 +10,9 @@
 
 - name: Include SSL bundle verifications
   ansible.builtin.include_tasks: bundle.yml
+
+- name: Include SSL clients verifications
+  ansible.builtin.include_tasks: client.yml
+  loop: "{{ ssl_clients }}"
+  loop_control:
+    loop_var: client

molecule/default/roles/ssl/vars/main.yml

@@ -1,7 +1,3 @@
 ---
 ssl_keys_ca_path: "{{ ssl_keys_ca_dir }}/{{ ssl_keys_ca_name }}"
-ssl_keys_server_path: "{{ ssl_keys_server_dir }}/{{ ssl_keys_server_name }}"
-
-ssl_certs_ca_path: "{{ ssl_certs_ca_dir }}/{{ ssl_certs_ca_name }}"
-ssl_certs_server_path: "{{ ssl_certs_server_dir }}/{{ ssl_certs_server_name }}"
 ssl_bundle_path: "{{ ssl_certs_server_dir }}/{{ ssl_bundle_name }}"

molecule/default/roles/system/files/system-test-script

@@ -0,0 +1,3 @@
+#!/bin/sh
+
+echo "molecule custom script"