control 'default' do
  nodes_dir = '/tmp/kitchen/nodes'
  output = command("ls #{nodes_dir}").stdout.strip
  node_json = "#{nodes_dir}/#{output}"
  if file(node_json).exist?
    node = json(node_json).params

    case node['automatic']['platform_family']
    when 'rhel'
      describe file '/etc/selinux/config' do
        its('mode') { should cmp '00644' }
      end
      firewall_package_name = node['default']['firewall']['redhat7_iptables'] ? 'iptables' : 'firewalld'
      firewall_chain = node['default']['firewall']['redhat7_iptables'] ? 'INPUT' : 'INPUT_direct'
      firewall_rules = [
        "-A #{firewall_chain} -p tcp -m tcp -m multiport --dports 80 -m comment --comment http -j ACCEPT",
        "-A #{firewall_chain} -p tcp -m tcp -m multiport --dports 443 -m comment --comment https -j ACCEPT",
        "-A #{firewall_chain} -p tcp -m tcp -m multiport --dports 22 -m comment --comment ssh -j ACCEPT",
      ]
    when 'debian'
      firewall_package_name = 'ufw'
      firewall_chain = 'ufw-user-input'
      firewall_rules = [
        "-A #{firewall_chain} -p tcp -m tcp --dport 80 -j ACCEPT",
        "-A #{firewall_chain} -p tcp -m tcp --dport 80 -j ACCEPT",
        "-A #{firewall_chain} -p tcp -m tcp --dport 80 -j ACCEPT",
      ]
    end

    describe package firewall_package_name do
      it { should be_installed }
    end

    firewall_rules.each do |rule|
      describe iptables do
        it { should have_rule(rule) }
      end
    end

    describe package node['default']['apache']['package'] do
      it { should be_installed }
    end

    describe service node['default']['apache']['package'] do
      it { should be_enabled }
      it { should be_running }
    end

  else
    puts "File #{node_json} does not exist, skiping attribute-depending checks"
  end
end