--- /dev/null
+extends: default
+
+rules:
+ braces:
+ max-spaces-inside: 1
+ level: error
+ brackets:
+ max-spaces-inside: 1
+ level: error
+ line-length: disable
+ truthy: disable
--- /dev/null
+# Molecule managed
+
+{% if item.registry is defined %}
+FROM {{ item.registry.url }}/{{ item.image }}
+{% else %}
+FROM {{ item.image }}
+{% endif %}
+
+RUN if [ $(command -v apt-get) ]; then apt-get update && apt-get install -y python sudo bash ca-certificates && apt-get clean; \
+ elif [ $(command -v dnf) ]; then dnf makecache && dnf --assumeyes install python sudo python-devel python*-dnf bash && dnf clean all; \
+ elif [ $(command -v yum) ]; then yum makecache fast && yum install -y python sudo yum-plugin-ovl bash && sed -i 's/plugins=0/plugins=1/g' /etc/yum.conf && yum clean all; \
+ elif [ $(command -v zypper) ]; then zypper refresh && zypper install -y python sudo bash python-xml && zypper clean -a; \
+ elif [ $(command -v apk) ]; then apk update && apk add --no-cache python sudo bash ca-certificates; \
+ elif [ $(command -v xbps-install) ]; then xbps-install -Syu && xbps-install -y python sudo bash ca-certificates && xbps-remove -O; fi
--- /dev/null
+---
+dependency:
+ name: galaxy
+driver:
+ name: docker
+lint:
+ name: yamllint
+platforms:
+ - name: centos7
+ image: couchbase/centos7-systemd
+ privileged: true
+ command: ""
+ volumes:
+ - /sys/fs/cgroup:/sys/fs/cgroup:ro
+
+ - name: ubuntu18
+ image: solita/ubuntu-systemd:18.04
+ command: /sbin/init
+ privileged: true
+ volumes:
+ - /lib/modules:/lib/modules:ro
+provisioner:
+ name: ansible
+ env:
+ ANSIBLE_ROLES_PATH: ../../../../test/roles
+ lint:
+ name: ansible-lint
+verifier:
+ name: testinfra
+ options:
+ verbose: true
+ lint:
+ name: flake8
--- /dev/null
+---
+- name: Converge
+ hosts: all
+ roles:
+ - role: firewall
--- /dev/null
+---
+- name: Prepare
+ hosts: all
+ roles:
+ - prepare-firewall
--- /dev/null
+import os
+
+import testinfra.utils.ansible_runner
+
+testinfra_hosts = testinfra.utils.ansible_runner.AnsibleRunner(
+ os.environ['MOLECULE_INVENTORY_FILE']).get_hosts('all')
+
+
+def test_firewall_service_disabled(host):
+ distribution = host.system_info.distribution
+ if distribution == "centos":
+ svc = "firewalld"
+ elif distribution == "ubuntu":
+ svc = "ufw"
+ service = host.service(svc)
+
+ assert not service.is_running
+ assert not service.is_enabled
--- /dev/null
+---
+firewall:
+ package_name:
+ RedHat: 'firewalld'
+ Debian: 'ufw'
--- /dev/null
+---
+- name: Install firewall
+ package:
+ name: "{{ firewall.package_name[ansible_facts.os_family] }}"
+ state: present
+
+- name: Start and enable firewall
+ service:
+ name: "{{ firewall.package_name[ansible_facts.os_family] }}"
+ state: started
+ enabled: true