---
- name: Verify rendered Notarius configuration
  hosts: localhost
  gather_facts: false
  tasks:
    - name: Read rendered configuration
      become: true
      ansible.builtin.slurp:
        src: /usr/local/etc/notarius/config.yml
      register: notarius_rendered_config

    - name: Check rendered configuration
      ansible.builtin.assert:
        that:
          - '(notarius_rendered_config.content | b64decode | from_yaml) == notarius_expected_config'

    - name: Validate rendered configuration
      ansible.builtin.command:
        argv:
          - /usr/local/bin/notarius
          - config
          - validate
          - --config
          - /usr/local/etc/notarius/config.yml
      changed_when: false