added gitea actions, ansible testing, debian12 support

.gitea/workflows/test.yml

@@ -0,0 +1,52 @@
+---
+name: test
+on: [push]
+
+jobs:
+  lint:
+    name: Linting
+    runs-on: ubuntu-latest
+    container:
+      image: git.ednz.fr/container-factory/ansible-runner:act-latest
+      credentials:
+        username: ${{ secrets.ACTIONS_USER }}
+        password: ${{ secrets.ACTIONS_TOKEN }}
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v3
+
+      - name: "Ansible lint"
+        run: ansible-lint --force-color
+        working-directory: ${{ gitea.workspace }}
+
+      - name: "YAML lint"
+        run: yamllint . -f colored -c .yamllint
+        working-directory: ${{ gitea.workspace }}
+
+  molecule-test:
+    name: Molecule tests
+    runs-on: ubuntu-latest
+    needs: lint
+    container:
+      image: git.ednz.fr/container-factory/ansible-runner:act-latest
+      credentials:
+        username: ${{ secrets.ACTIONS_USER }}
+        password: ${{ secrets.ACTIONS_TOKEN }}
+    strategy:
+      matrix:
+        test_os: [debian11, debian12, ubuntu2004, ubuntu2204]
+        scenario: [default, with_custom_config]
+    env:
+      ANSIBLE_HOST_KEY_CHECKING: 'false'
+      ANSIBLE_FORCE_COLOR: 'true'
+      ANSIBLE_PYTHON_INTERPRETER: /usr/bin/python3
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v3
+
+      - name: "Molecule test"
+        run: molecule test -s ${{ matrix.scenario }}
+        shell: bash
+        working-directory: ${{ gitea.workspace }}
+        env:
+          MOLECULE_TEST_OS: ${{ matrix.test_os }}

.gitlab-ci.yml

@@ -1,82 +0,0 @@
----
-stages:
-  - verify
-  - test-default
-  - test-with-custom-config
-
-image:
-  name: registry.ednz.fr/forge/ansible-runner
-
-variables:
-  ANSIBLE_HOST_KEY_CHECKING: 'false'
-  ANSIBLE_FORCE_COLOR: 'true'
-  ANSIBLE_PYTHON_INTERPRETER: /usr/bin/python3
-  DOCKER_AUTH_CONFIG: $CI_DOCKER_AUTH_CONFIG
-
-.stage-test-default:
-  stage: test-default
-
-.stage-test-with-custom-config:
-  stage: test-with-custom-config
-
-.variables-ubuntu-2004:
-  variables:
-    MOLECULE_TEST_OS: "ubuntu2004"
-
-.variables-ubuntu-2204:
-  variables:
-    MOLECULE_TEST_OS: "ubuntu2204"
-
-.variables-debian-11:
-  variables:
-    MOLECULE_TEST_OS: "debian11"
-
-.script-molecule-test-default:
-  script:
-    - molecule test
-
-.script-molecule-test-with-custom-config:
-  script:
-    - molecule test -s with_custom_config
-
-ansible-verify:
-  stage: verify
-  script:
-    - yamllint . -c .yamllint
-    - ansible-lint
-
-ansible-test-ubuntu-2004-default:
-  extends:
-    - .stage-test-default
-    - .variables-ubuntu-2004
-    - .script-molecule-test-default
-
-ansible-test-ubuntu-2204-default:
-  extends:
-    - .stage-test-default
-    - .variables-ubuntu-2204
-    - .script-molecule-test-default
-
-ansible-test-debian-11-default:
-  extends:
-    - .stage-test-default
-    - .variables-debian-11
-    - .script-molecule-test-default
-
-ansible-test-ubuntu-2004-with-custom-config:
-  extends:
-    - .stage-test-with-custom-config
-    - .variables-ubuntu-2004
-    - .script-molecule-test-with-custom-config
-
-ansible-test-ubuntu-2204-with-custom-config:
-  extends:
-    - .stage-test-with-custom-config
-    - .variables-ubuntu-2204
-    - .script-molecule-test-with-custom-config
-
-ansible-test-debian-11-with-custom-config:
-  extends:
-    - .stage-test-with-custom-config
-    - .variables-debian-11
-    - .script-molecule-test-with-custom-config

LICENSE

@@ -1,6 +1,6 @@
 The MIT License (MIT)
 
-Copyright (c) 2017 Jeff Geerling
+Copyright (c) 2017 Bertrand Lanson
 
 Permission is hereby granted, free of charge, to any person obtaining a copy of
 this software and associated documentation files (the "Software"), to deal in

README.md

@@ -1,4 +1,4 @@
-Renew nomad certificates
+renew_nomad_certificates
 =========
 > This repository is only a mirror. Development and testing is done on a private gitlab server.
 

meta/main.yml

@@ -15,6 +15,7 @@ galaxy_info:
     - name: Debian
       versions:
         - bullseye
+        - bookworm
   galaxy_tags:
     - 'ubuntu'
     - 'debian'

molecule/default/molecule.yml

@@ -20,7 +20,7 @@ provisioner:
     defaults:
       remote_tmp: /tmp/.ansible
 verifier:
-  name: testinfra
+  name: ansible
 scenario:
   name: default
   test_sequence:

molecule/default/tests/conftest.py

@@ -1,22 +0,0 @@
-"""PyTest Fixtures."""
-
-import os
-
-import pytest
-
-
-def pytest_runtest_setup(item):
-    """Run tests only when under molecule with testinfra installed."""
-    try:
-        import testinfra
-    except ImportError:
-        pytest.skip("Test requires testinfra", allow_module_level=True)
-    if "MOLECULE_INVENTORY_FILE" in os.environ:
-        pytest.testinfra_hosts = testinfra.utils.ansible_runner.AnsibleRunner(
-            os.environ["MOLECULE_INVENTORY_FILE"],
-        ).get_hosts("all")
-    else:
-        pytest.skip(
-            "Test should run only from inside molecule.",
-            allow_module_level=True,
-        )

molecule/default/tests/test_default.py

@@ -1,50 +0,0 @@
-"""Role testing files using testinfra."""
-
-
-def test_hosts_file(host):
-    """Validate /etc/hosts file."""
-    etc_hosts = host.file("/etc/hosts")
-    assert etc_hosts.exists
-    assert etc_hosts.user == "root"
-    assert etc_hosts.group == "root"
-
-def test_nomad_template_config(host):
-    """Validate /etc/consul-template.d/nomad/ files."""
-    etc_nomad_template_d_nomad_config_hcl = host.file("/etc/consul-template.d/nomad/nomad_config.hcl")
-    assert etc_nomad_template_d_nomad_config_hcl.exists
-    assert etc_nomad_template_d_nomad_config_hcl.user == "nomad"
-    assert etc_nomad_template_d_nomad_config_hcl.group == "nomad"
-    assert etc_nomad_template_d_nomad_config_hcl.mode == 0o600
-
-def test_template_files(host):
-    """Validate /etc/consul-template.d/nomad/templates/ files."""
-    nomad_ca_pem_tpl = host.file("/etc/consul-template.d/nomad/templates/nomad_ca.pem.tpl")
-    nomad_cert_pem_tpl = host.file("/etc/consul-template.d/nomad/templates/nomad_cert.pem.tpl")
-    nomad_key_pem_tpl = host.file("/etc/consul-template.d/nomad/templates/nomad_key.pem.tpl")
-    for file in nomad_cert_pem_tpl, nomad_key_pem_tpl:
-        assert file.exists
-        assert file.user == "nomad"
-        assert file.group == "nomad"
-        assert file.mode == 0o600
-    assert nomad_ca_pem_tpl.content_string == '{{ with secret "pki/issue/your-issuer" "common_name=nomad01.example.com" "ttl=90d" "alt_names=localhost" "ip_sans=127.0.0.1" }}\n{{ .Data.issuing_ca }}\n{{ end }}\n'
-    assert nomad_cert_pem_tpl.content_string == '{{ with secret "pki/issue/your-issuer" "common_name=nomad01.example.com" "ttl=90d" "alt_names=localhost" "ip_sans=127.0.0.1" }}\n{{ .Data.certificate }}\n{{ .Data.issuing_ca }}\n{{ end }}\n'
-    assert nomad_key_pem_tpl.content_string == '{{ with secret "pki/issue/your-issuer" "common_name=nomad01.example.com" "ttl=90d" "alt_names=localhost" "ip_sans=127.0.0.1" }}\n{{ .Data.private_key }}\n{{ end }}\n'
-
-def test_nomad_certs_service_file(host):
-    """Validate nomad-certs service file."""
-    etc_systemd_system_nomad_certs_service = host.file("/etc/systemd/system/nomad-certs.service")
-    assert etc_systemd_system_nomad_certs_service.exists
-    assert etc_systemd_system_nomad_certs_service.user == "root"
-    assert etc_systemd_system_nomad_certs_service.group == "root"
-    assert etc_systemd_system_nomad_certs_service.mode == 0o644
-    assert etc_systemd_system_nomad_certs_service.content_string != ""
-
-def test_nomad_certs_service(host):
-    """Validate nomad-certs service."""
-    nomad_certs_service = host.service("nomad-certs.service")
-    assert nomad_certs_service.is_enabled
-    assert not nomad_certs_service.is_running
-    assert nomad_certs_service.systemd_properties["Restart"] == "on-failure"
-    assert nomad_certs_service.systemd_properties["User"] == "nomad"
-    assert nomad_certs_service.systemd_properties["Group"] == "nomad"
-    assert nomad_certs_service.systemd_properties["FragmentPath"] == "/etc/systemd/system/nomad-certs.service"

molecule/default/verify.yml

@@ -0,0 +1,154 @@
+---
+- name: Verify
+  hosts: all
+  gather_facts: false
+  tasks:
+    - name: "Test: file /etc/hosts"
+      block:
+        - name: "Stat file /etc/hosts"
+          ansible.builtin.stat:
+            path: "/etc/hosts"
+          register: stat_etc_hosts
+
+        - name: "Verify file /etc/hosts"
+          ansible.builtin.assert:
+            that:
+              - stat_etc_hosts.stat.exists
+              - stat_etc_hosts.stat.isreg
+              - stat_etc_hosts.stat.pw_name == 'root'
+              - stat_etc_hosts.stat.gr_name == 'root'
+
+    - name: "Test: directory /etc/consul-template.d/nomad"
+      block:
+        - name: "Stat directory /etc/consul-template.d/nomad"
+          ansible.builtin.stat:
+            path: "/etc/consul-template.d/nomad"
+          register: stat_etc_consul_template_d_nomad
+
+        - name: "Stat file /etc/consul-template.d/nomad/nomad_config.hcl"
+          ansible.builtin.stat:
+            path: "/etc/consul-template.d/nomad/nomad_config.hcl"
+          register: stat_etc_consul_template_d_nomad_nomad_config_hcl
+
+        - name: "Slurp file /etc/consul-template.d/nomad/nomad_config.hcl"
+          ansible.builtin.slurp:
+            src: "/etc/consul-template.d/nomad/nomad_config.hcl"
+          register: slurp_etc_consul_template_d_nomad_nomad_config_hcl
+
+        - name: "Verify directory /etc/consul-template.d/nomad"
+          ansible.builtin.assert:
+            that:
+              - stat_etc_consul_template_d_nomad.stat.exists
+              - stat_etc_consul_template_d_nomad.stat.isdir
+              - stat_etc_consul_template_d_nomad.stat.pw_name == 'nomad'
+              - stat_etc_consul_template_d_nomad.stat.gr_name == 'nomad'
+              - stat_etc_consul_template_d_nomad.stat.mode == '0755'
+              - stat_etc_consul_template_d_nomad_nomad_config_hcl.stat.exists
+              - stat_etc_consul_template_d_nomad_nomad_config_hcl.stat.isreg
+              - stat_etc_consul_template_d_nomad_nomad_config_hcl.stat.pw_name == 'nomad'
+              - stat_etc_consul_template_d_nomad_nomad_config_hcl.stat.gr_name == 'nomad'
+              - stat_etc_consul_template_d_nomad_nomad_config_hcl.stat.mode == '0600'
+              - slurp_etc_consul_template_d_nomad_nomad_config_hcl.content != ''
+
+    - name: "Test: directory /etc/consul-template.d/nomad/templates"
+      block:
+        - name: "Stat directory /etc/consul-template.d/nomad/templates"
+          ansible.builtin.stat:
+            path: "/etc/consul-template.d/nomad/templates"
+          register: stat_etc_consul_template_d_nomad_templates
+
+        - name: "Find in directory /etc/consul-template.d/nomad/templates"
+          ansible.builtin.find:
+            paths: "/etc/consul-template.d/nomad/templates"
+            file_type: file
+          register: find_etc_consul_template_d_nomad_templates
+
+        - name: "Stat in directory /etc/consul-template.d/nomad/templates"
+          ansible.builtin.stat:
+            path: "{{ item.path }}"
+          loop: "{{ find_etc_consul_template_d_nomad_templates.files }}"
+          register: stat_etc_consul_template_d_nomad_templates
+
+        - name: "Slurp in directory /etc/consul-template.d/nomad/templates"
+          ansible.builtin.slurp:
+            src: "{{ item.path }}"
+          loop: "{{ find_etc_consul_template_d_nomad_templates.files }}"
+          register: slurp_etc_consul_template_d_nomad_templates
+
+        - name: "Verify file /etc/consul-template.d/nomad/templates/nomad_ca.pem.tpl"
+          vars:
+            nomad_ca_file: |
+              {% raw %}{{ with secret "pki/issue/your-issuer" "common_name=nomad01.example.com" "ttl=90d" "alt_names=localhost" "ip_sans=127.0.0.1" }}
+              {{ .Data.issuing_ca }}
+              {{ end }}{% endraw %}
+          ansible.builtin.assert:
+            that:
+              - item.item.isreg
+              - item.item.pw_name == 'nomad'
+              - item.item.gr_name == 'nomad'
+              - item.item.mode == '0600'
+              - "(item.content|b64decode) == nomad_ca_file"
+          loop: "{{ slurp_etc_consul_template_d_nomad_templates.results }}"
+          when: (item.item.path | basename) == 'nomad_ca.pem.tpl'
+
+        - name: "Verify file /etc/consul-template.d/nomad/templates/nomad_cert.pem.tpl"
+          vars:
+            nomad_cert_file: |
+              {% raw %}{{ with secret "pki/issue/your-issuer" "common_name=nomad01.example.com" "ttl=90d" "alt_names=localhost" "ip_sans=127.0.0.1" }}
+              {{ .Data.certificate }}
+              {{ .Data.issuing_ca }}
+              {{ end }}{% endraw %}
+          ansible.builtin.assert:
+            that:
+              - item.item.isreg
+              - item.item.pw_name == 'nomad'
+              - item.item.gr_name == 'nomad'
+              - item.item.mode == '0600'
+              - "(item.content|b64decode) == nomad_cert_file"
+          loop: "{{ slurp_etc_consul_template_d_nomad_templates.results }}"
+          when: (item.item.path | basename) == 'nomad_cert.pem.tpl'
+
+        - name: "Verify file /etc/consul-template.d/nomad/templates/nomad_key.pem.tpl"
+          vars:
+            nomad_key_file: |
+              {% raw %}{{ with secret "pki/issue/your-issuer" "common_name=nomad01.example.com" "ttl=90d" "alt_names=localhost" "ip_sans=127.0.0.1" }}
+              {{ .Data.private_key }}
+              {{ end }}{% endraw %}
+          ansible.builtin.assert:
+            that:
+              - item.item.isreg
+              - item.item.pw_name == 'nomad'
+              - item.item.gr_name == 'nomad'
+              - item.item.mode == '0600'
+              - "(item.content|b64decode) == nomad_key_file"
+          loop: "{{ slurp_etc_consul_template_d_nomad_templates.results }}"
+          when: (item.item.path | basename) == 'nomad_key.pem.tpl'
+
+    - name: "Test: service nomad-certs"
+      block:
+        - name: "Get service nomad-certs"
+          ansible.builtin.service_facts:
+
+        - name: "Stat file /etc/systemd/system/nomad-certs.service"
+          ansible.builtin.stat:
+            path: "/etc/systemd/system/nomad-certs.service"
+          register: stat_etc_systemd_system_nomad_certs_service
+
+        - name: "Slurp file /etc/systemd/system/nomad.service"
+          ansible.builtin.slurp:
+            src: "/etc/systemd/system/nomad-certs.service"
+          register: slurp_etc_systemd_system_nomad_certs_service
+
+        - name: "Verify service nomad"
+          ansible.builtin.assert:
+            that:
+              - stat_etc_systemd_system_nomad_certs_service.stat.exists
+              - stat_etc_systemd_system_nomad_certs_service.stat.isreg
+              - stat_etc_systemd_system_nomad_certs_service.stat.pw_name == 'root'
+              - stat_etc_systemd_system_nomad_certs_service.stat.gr_name == 'root'
+              - stat_etc_systemd_system_nomad_certs_service.stat.mode == '0644'
+              - slurp_etc_systemd_system_nomad_certs_service.content != ''
+              - ansible_facts.services['nomad-certs.service'] is defined
+              - ansible_facts.services['nomad-certs.service']['source'] == 'systemd'
+              - ansible_facts.services['nomad-certs.service']['state'] == 'stopped'
+              - ansible_facts.services['nomad-certs.service']['status'] == 'enabled'

molecule/with_custom_config/molecule.yml

@@ -20,7 +20,7 @@ provisioner:
     defaults:
       remote_tmp: /tmp/.ansible
 verifier:
-  name: testinfra
+  name: ansible
 scenario:
   name: with_custom_config
   test_sequence:

molecule/with_custom_config/tests/conftest.py

@@ -1,22 +0,0 @@
-"""PyTest Fixtures."""
-from __future__ import absolute_import
-
-import os
-
-import pytest
-
-
-def pytest_runtest_setup(item):
-    """Run tests only when under molecule with testinfra installed."""
-    try:
-        import testinfra
-    except ImportError:
-        pytest.skip("Test requires testinfra", allow_module_level=True)
-    if "MOLECULE_INVENTORY_FILE" in os.environ:
-        pytest.testinfra_hosts = testinfra.utils.ansible_runner.AnsibleRunner(
-            os.environ["MOLECULE_INVENTORY_FILE"]
-        ).get_hosts("all")
-    else:
-        pytest.skip(
-            "Test should run only from inside molecule.", allow_module_level=True
-        )

molecule/with_custom_config/tests/test_default.py

@@ -1,50 +0,0 @@
-"""Role testing files using testinfra."""
-
-
-def test_hosts_file(host):
-    """Validate /etc/hosts file."""
-    etc_hosts = host.file("/etc/hosts")
-    assert etc_hosts.exists
-    assert etc_hosts.user == "root"
-    assert etc_hosts.group == "root"
-
-def test_nomad_template_config(host):
-    """Validate /etc/consul-template.d/nomad/ files."""
-    etc_nomad_template_d_nomad_config_hcl = host.file("/etc/consul-template.d/nomad/nomad_config.hcl")
-    assert etc_nomad_template_d_nomad_config_hcl.exists
-    assert etc_nomad_template_d_nomad_config_hcl.user == "nomad"
-    assert etc_nomad_template_d_nomad_config_hcl.group == "nomad"
-    assert etc_nomad_template_d_nomad_config_hcl.mode == 0o600
-
-def test_template_files(host):
-    """Validate /etc/consul-template.d/nomad/templates/ files."""
-    nomad_ca_pem_tpl = host.file("/etc/consul-template.d/nomad/templates/nomad_ca.pem.tpl")
-    nomad_cert_pem_tpl = host.file("/etc/consul-template.d/nomad/templates/nomad_cert.pem.tpl")
-    nomad_key_pem_tpl = host.file("/etc/consul-template.d/nomad/templates/nomad_key.pem.tpl")
-    for file in nomad_cert_pem_tpl, nomad_key_pem_tpl:
-        assert file.exists
-        assert file.user == "nomad"
-        assert file.group == "nomad"
-        assert file.mode == 0o600
-    assert nomad_ca_pem_tpl.content_string == '{{ with secret "pki/issue/your-issuer" "common_name=nomad01.example.com" "ttl=90d" "alt_names=localhost,server.dc1.nomad,client.dc1.nomad,nomad.service.nomad" "ip_sans=127.0.0.1" }}\n{{ .Data.issuing_ca }}\n{{ end }}\n'
-    assert nomad_cert_pem_tpl.content_string == '{{ with secret "pki/issue/your-issuer" "common_name=nomad01.example.com" "ttl=90d" "alt_names=localhost,server.dc1.nomad,client.dc1.nomad,nomad.service.nomad" "ip_sans=127.0.0.1" }}\n{{ .Data.certificate }}\n{{ .Data.issuing_ca }}\n{{ end }}\n'
-    assert nomad_key_pem_tpl.content_string == '{{ with secret "pki/issue/your-issuer" "common_name=nomad01.example.com" "ttl=90d" "alt_names=localhost,server.dc1.nomad,client.dc1.nomad,nomad.service.nomad" "ip_sans=127.0.0.1" }}\n{{ .Data.private_key }}\n{{ end }}\n'
-
-def test_nomad_certs_service_file(host):
-    """Validate nomad-certs service file."""
-    etc_systemd_system_nomad_certs_service = host.file("/etc/systemd/system/nomad-certs.service")
-    assert etc_systemd_system_nomad_certs_service.exists
-    assert etc_systemd_system_nomad_certs_service.user == "root"
-    assert etc_systemd_system_nomad_certs_service.group == "root"
-    assert etc_systemd_system_nomad_certs_service.mode == 0o644
-    assert etc_systemd_system_nomad_certs_service.content_string != ""
-
-def test_nomad_certs_service(host):
-    """Validate nomad-certs service."""
-    nomad_certs_service = host.service("nomad-certs.service")
-    assert nomad_certs_service.is_enabled
-    assert not nomad_certs_service.is_running
-    assert nomad_certs_service.systemd_properties["Restart"] == "on-failure"
-    assert nomad_certs_service.systemd_properties["User"] == "nomad"
-    assert nomad_certs_service.systemd_properties["Group"] == "nomad"
-    assert nomad_certs_service.systemd_properties["FragmentPath"] == "/etc/systemd/system/nomad-certs.service"

molecule/with_custom_config/verify.yml

@@ -0,0 +1,154 @@
+---
+- name: Verify
+  hosts: all
+  gather_facts: false
+  tasks:
+    - name: "Test: file /etc/hosts"
+      block:
+        - name: "Stat file /etc/hosts"
+          ansible.builtin.stat:
+            path: "/etc/hosts"
+          register: stat_etc_hosts
+
+        - name: "Verify file /etc/hosts"
+          ansible.builtin.assert:
+            that:
+              - stat_etc_hosts.stat.exists
+              - stat_etc_hosts.stat.isreg
+              - stat_etc_hosts.stat.pw_name == 'root'
+              - stat_etc_hosts.stat.gr_name == 'root'
+
+    - name: "Test: directory /etc/consul-template.d/nomad"
+      block:
+        - name: "Stat directory /etc/consul-template.d/nomad"
+          ansible.builtin.stat:
+            path: "/etc/consul-template.d/nomad"
+          register: stat_etc_consul_template_d_nomad
+
+        - name: "Stat file /etc/consul-template.d/nomad/nomad_config.hcl"
+          ansible.builtin.stat:
+            path: "/etc/consul-template.d/nomad/nomad_config.hcl"
+          register: stat_etc_consul_template_d_nomad_nomad_config_hcl
+
+        - name: "Slurp file /etc/consul-template.d/nomad/nomad_config.hcl"
+          ansible.builtin.slurp:
+            src: "/etc/consul-template.d/nomad/nomad_config.hcl"
+          register: slurp_etc_consul_template_d_nomad_nomad_config_hcl
+
+        - name: "Verify directory /etc/consul-template.d/nomad"
+          ansible.builtin.assert:
+            that:
+              - stat_etc_consul_template_d_nomad.stat.exists
+              - stat_etc_consul_template_d_nomad.stat.isdir
+              - stat_etc_consul_template_d_nomad.stat.pw_name == 'nomad'
+              - stat_etc_consul_template_d_nomad.stat.gr_name == 'nomad'
+              - stat_etc_consul_template_d_nomad.stat.mode == '0755'
+              - stat_etc_consul_template_d_nomad_nomad_config_hcl.stat.exists
+              - stat_etc_consul_template_d_nomad_nomad_config_hcl.stat.isreg
+              - stat_etc_consul_template_d_nomad_nomad_config_hcl.stat.pw_name == 'nomad'
+              - stat_etc_consul_template_d_nomad_nomad_config_hcl.stat.gr_name == 'nomad'
+              - stat_etc_consul_template_d_nomad_nomad_config_hcl.stat.mode == '0600'
+              - slurp_etc_consul_template_d_nomad_nomad_config_hcl.content != ''
+
+    - name: "Test: directory /etc/consul-template.d/nomad/templates"
+      block:
+        - name: "Stat directory /etc/consul-template.d/nomad/templates"
+          ansible.builtin.stat:
+            path: "/etc/consul-template.d/nomad/templates"
+          register: stat_etc_consul_template_d_nomad_templates
+
+        - name: "Find in directory /etc/consul-template.d/nomad/templates"
+          ansible.builtin.find:
+            paths: "/etc/consul-template.d/nomad/templates"
+            file_type: file
+          register: find_etc_consul_template_d_nomad_templates
+
+        - name: "Stat in directory /etc/consul-template.d/nomad/templates"
+          ansible.builtin.stat:
+            path: "{{ item.path }}"
+          loop: "{{ find_etc_consul_template_d_nomad_templates.files }}"
+          register: stat_etc_consul_template_d_nomad_templates
+
+        - name: "Slurp in directory /etc/consul-template.d/nomad/templates"
+          ansible.builtin.slurp:
+            src: "{{ item.path }}"
+          loop: "{{ find_etc_consul_template_d_nomad_templates.files }}"
+          register: slurp_etc_consul_template_d_nomad_templates
+
+        - name: "Verify file /etc/consul-template.d/nomad/templates/nomad_ca.pem.tpl"
+          vars:
+            nomad_ca_file: |
+              {% raw %}{{ with secret "pki/issue/your-issuer" "common_name=nomad01.example.com" "ttl=90d" "alt_names=localhost,server.dc1.nomad,client.dc1.nomad,nomad.service.nomad" "ip_sans=127.0.0.1" }}
+              {{ .Data.issuing_ca }}
+              {{ end }}{% endraw %}
+          ansible.builtin.assert:
+            that:
+              - item.item.isreg
+              - item.item.pw_name == 'nomad'
+              - item.item.gr_name == 'nomad'
+              - item.item.mode == '0600'
+              - "(item.content|b64decode) == nomad_ca_file"
+          loop: "{{ slurp_etc_consul_template_d_nomad_templates.results }}"
+          when: (item.item.path | basename) == 'nomad_ca.pem.tpl'
+
+        - name: "Verify file /etc/consul-template.d/nomad/templates/nomad_cert.pem.tpl"
+          vars:
+            nomad_cert_file: |
+              {% raw %}{{ with secret "pki/issue/your-issuer" "common_name=nomad01.example.com" "ttl=90d" "alt_names=localhost,server.dc1.nomad,client.dc1.nomad,nomad.service.nomad" "ip_sans=127.0.0.1" }}
+              {{ .Data.certificate }}
+              {{ .Data.issuing_ca }}
+              {{ end }}{% endraw %}
+          ansible.builtin.assert:
+            that:
+              - item.item.isreg
+              - item.item.pw_name == 'nomad'
+              - item.item.gr_name == 'nomad'
+              - item.item.mode == '0600'
+              - "(item.content|b64decode) == nomad_cert_file"
+          loop: "{{ slurp_etc_consul_template_d_nomad_templates.results }}"
+          when: (item.item.path | basename) == 'nomad_cert.pem.tpl'
+
+        - name: "Verify file /etc/consul-template.d/nomad/templates/nomad_key.pem.tpl"
+          vars:
+            nomad_key_file: |
+              {% raw %}{{ with secret "pki/issue/your-issuer" "common_name=nomad01.example.com" "ttl=90d" "alt_names=localhost,server.dc1.nomad,client.dc1.nomad,nomad.service.nomad" "ip_sans=127.0.0.1" }}
+              {{ .Data.private_key }}
+              {{ end }}{% endraw %}
+          ansible.builtin.assert:
+            that:
+              - item.item.isreg
+              - item.item.pw_name == 'nomad'
+              - item.item.gr_name == 'nomad'
+              - item.item.mode == '0600'
+              - "(item.content|b64decode) == nomad_key_file"
+          loop: "{{ slurp_etc_consul_template_d_nomad_templates.results }}"
+          when: (item.item.path | basename) == 'nomad_key.pem.tpl'
+
+    - name: "Test: service nomad-certs"
+      block:
+        - name: "Get service nomad-certs"
+          ansible.builtin.service_facts:
+
+        - name: "Stat file /etc/systemd/system/nomad-certs.service"
+          ansible.builtin.stat:
+            path: "/etc/systemd/system/nomad-certs.service"
+          register: stat_etc_systemd_system_nomad_certs_service
+
+        - name: "Slurp file /etc/systemd/system/nomad.service"
+          ansible.builtin.slurp:
+            src: "/etc/systemd/system/nomad-certs.service"
+          register: slurp_etc_systemd_system_nomad_certs_service
+
+        - name: "Verify service nomad"
+          ansible.builtin.assert:
+            that:
+              - stat_etc_systemd_system_nomad_certs_service.stat.exists
+              - stat_etc_systemd_system_nomad_certs_service.stat.isreg
+              - stat_etc_systemd_system_nomad_certs_service.stat.pw_name == 'root'
+              - stat_etc_systemd_system_nomad_certs_service.stat.gr_name == 'root'
+              - stat_etc_systemd_system_nomad_certs_service.stat.mode == '0644'
+              - slurp_etc_systemd_system_nomad_certs_service.content != ''
+              - ansible_facts.services['nomad-certs.service'] is defined
+              - ansible_facts.services['nomad-certs.service']['source'] == 'systemd'
+              - ansible_facts.services['nomad-certs.service']['state'] == 'stopped'
+              - ansible_facts.services['nomad-certs.service']['status'] == 'enabled'