---
- name: Determine if system is booted with systemd
  when: __firewall_is_booted is not defined
  block:
    - name: Run systemctl
      # noqa command-instead-of-module
      ansible.builtin.command: systemctl is-system-running
      register: __is_system_running
      changed_when: false
      failed_when: false
      check_mode: "{{ __firewall_test_check_mode | d(ansible_check_mode) }}"

    - name: Require installed systemd
      ansible.builtin.fail:
        msg: "Error: This role requires systemd to be installed."
      when: '"No such file or directory" in __is_system_running.msg | d("")'

    - name: Set flag to indicate that systemd runtime operations are available
      ansible.builtin.set_fact:
        # see https://www.man7.org/linux/man-pages/man1/systemctl.1.html#:~:text=is-system-running%20output
        __firewall_is_booted: "{{ __is_system_running.stdout != 'offline' }}"

- name: Install firewalld
  ansible.builtin.package:
    name: "{{ __firewall_packages_base + __firewall_packages_extra }}"
    state: present
    use: "{{ (__firewall_is_ostree | d(false)) | ternary('ansible.posix.rhel_rpm_ostree', omit) }}"
  register: firewall_package_result
  check_mode: "{{ __firewall_test_check_mode | d(ansible_check_mode) }}"

- name: Handle reboot for transactional update systems
  when:
    - __firewall_is_transactional | d(false)
    - firewall_package_result is changed
  block:
    - name: Notify user that reboot is needed to apply changes
      ansible.builtin.debug:
        msg: >
          Reboot required to apply changes due to transactional updates.

    - name: Reboot transactional update systems
      ansible.builtin.reboot:
        msg: Rebooting the system to apply transactional update changes.
      when: firewall_transactional_update_reboot_ok | bool

    - name: Fail if reboot is needed and not set
      ansible.builtin.fail:
        msg: >
          Reboot is required but not allowed. Please set 'firewall_transactional_update_reboot_ok' to proceed.
      when:
        - firewall_transactional_update_reboot_ok is none