---
# site.yml — IEC 62443-3-3 SL2 Compliance Validation
#
# Entry point for the compliance testing framework. This playbook:
#
#   1. Runs against all hosts in the inventory
#   2. Gathers facts first (ansible_date_time, ansible_user_id, etc.)
#   3. Executes each FR suite as a named task inside an ignore_errors block
#   4. Invokes library/report.yml to aggregate test_results[] and write JSON
#
# Usage:
#   ansible-playbook -i inventory.ini playbooks/site.yml --limit <host> -K
#   ./run.sh --limit <host> -K
#
# Adding a new suite:
#   Copy the block below, change the name and include_tasks path:
#
#     - name: "Suite: FRN — Category Name"
#       block:
#         - ansible.builtin.include_tasks: suites/frN_category.yml
#       ignore_errors: yes
#
# Variables:
#   report_dir: Where JSON reports land (default: ./reports, created locally)

- name: "IEC 62443-3-3 SL2 Compliance — All Targets"
  hosts: all
  gather_facts: yes
  become: yes
  vars:
    report_dir: "./reports"

  pre_tasks:
    - name: "Ensure report directory exists"
      ansible.builtin.file:
        path: "{{ report_dir }}"
        state: directory
        mode: "0755"
      delegate_to: localhost
      run_once: true

  tasks:
    # ─────── FR1: Identification & Authentication ──────────────
    - name: "Suite: FR1 — Identification & Authentication Control"
      block:
        - ansible.builtin.include_tasks: suites/fr1_auth.yml
      ignore_errors: yes

    # ─────── FR2: Use Control ─────────────────────────────────
    - name: "Suite: FR2 — Use Control"
      block:
        - ansible.builtin.include_tasks: suites/fr2_use_control.yml
      ignore_errors: yes

    # ─────── FR5: Restricted Data Flow ────────────────────────
    - name: "Suite: FR5 — Restricted Data Flow"
      block:
        - ansible.builtin.include_tasks: suites/fr5_data_flow.yml
      ignore_errors: yes

    # TODO: Add FR3, FR4, FR6, FR7 suites

    # ─────── REPORT ───────────────────────────────────────────
    - name: "Generate compliance report"
      ansible.builtin.include_tasks: library/report.yml