---
- name: Set platform/version specific variables
  ansible.builtin.include_tasks: set_vars.yml
- name: Setup firewalld
  ansible.builtin.include_tasks: firewalld.yml
- name: Check which conflicting services are enabled
  # noqa command-instead-of-module
  ansible.builtin.command: systemctl is-enabled "{{ item }}"
  register: __firewall_conflicting_services_status
  changed_when: false
  failed_when: false
  loop: "{{ __firewall_conflicting_services }}"
  when: firewall_disable_conflicting_services | bool
  check_mode: "{{ __firewall_test_check_mode | d(ansible_check_mode) }}"

- name: Attempt to stop and disable conflicting services
  ansible.builtin.service:
    name: "{{ item.item }}"
    state: "{{ 'stopped' if __firewall_is_booted else omit }}"
    enabled: false
  loop: "{{ __firewall_conflicting_services_status.results }}"
  check_mode: "{{ __firewall_test_check_mode | d(ansible_check_mode) }}"
  when:
    - firewall_disable_conflicting_services | bool
    - item.rc == 0

- name: Unmask firewalld service
  ansible.builtin.systemd:
    name: "{{ __firewall_service }}"
    masked: false
  check_mode: "{{ __firewall_test_check_mode | d(ansible_check_mode) }}"
  when: ansible_facts["service_mgr"] == "systemd"

- name: Enable and start firewalld service
  ansible.builtin.service:
    name: "{{ __firewall_service }}"
    enabled: true
    state: "{{ 'started' if __firewall_is_booted else omit }}"
  check_mode: "{{ __firewall_test_check_mode | d(ansible_check_mode) }}"

# NOTE: The old implementation of this role would always set permanent to True if it was not set,
# and would set runtime to True if it was not set
# so replicate that behavior here in order to maintain backwards compatibility in the module
# in case someone is erroneously using the module directly
- name: Configure firewall and/or gather facts
  vars:
    firewall_config_list: "{{ firewall is mapping | ternary([firewall], firewall) | list if firewall is not none else [] }}"
    firewall_lib_config_list: "{{ firewall_config_list | map('dict2items') | map('rejectattr', 'key', 'match', '^detailed$') | map('list') | map('items2dict') | list
      }}"
    _detailed:
      detailed: true
    firewall_detailed_facts: "{{ firewall == _detailed or firewall == [_detailed] }}"
  block:
    - name: Configure firewall
      firewall_lib:
        config_list: "{{ firewall_lib_config_list }}"
        online: "{{ __firewall_is_booted }}"
        __called_from_role: true
      when: firewall_lib_config_list | length > 0
      check_mode: "{{ __firewall_test_check_mode | d(ansible_check_mode) }}"
      register: firewall_lib_result

    - name: Show diffs
      ansible.builtin.debug:
        msg: "{{ firewall_lib_result.diff | to_nice_json }}"
      when:
        - ansible_check_mode or ansible_diff_mode or __firewall_test_check_mode | d(false)
        - firewall_lib_result.diff | d({}) | length > 0

    # If changed is false, short_circuit should be true - this means the module
    # was able to determine that the desired configuration is exactly the same as
    # the current configuration and no changes are needed.
    - name: Check if short circuit is false
      ansible.builtin.fail:
        msg: The role reported no changes but short circuit is false
      when:
        - not (__firewall_test_check_mode | d(ansible_check_mode))
        - not __firewall_debug_short_circuit_disable | d(false)
        - __firewall_debug_short_circuit | d(false)
        - not firewall_lib_result.changed
        - firewall_lib_result.short_circuit is defined
        - not firewall_lib_result.short_circuit | bool

    - name: Gather firewall ansible facts if no args
      when: firewall_lib_config_list | length == 0
      block:
        - name: Gather firewall config if no arguments
          firewall_lib_facts:
            online: "{{ __firewall_is_booted }}"
            detailed: "{{ firewall_detailed_facts }}"
          register: __firewalld_facts

        - name: Update firewalld_config fact
          ansible.builtin.set_fact:
            firewall_config: "{{ __firewalld_facts.firewall_config }}"