Refactor molecule testing to run a scenario per distro

14 files changed, 282 insertions, 66 deletions

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 5dd1c651..b894e31b 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -26,14 +26,13 @@ jobs:
       fail-fast: false
       matrix:
         molecule_distro:
-          - distro: archlinux
-            platform: "linux/amd64"
+          - name: archlinux
             runs_on: "ubuntu-latest"
-          - distro: ubuntu
-            platform: "linux/amd64"
+          - name: ubuntu
             runs_on: "ubuntu-latest"
-          - distro: raspberrypi
-            platform: "linux/arm64/v8"
+          - name: debian
+            runs_on: "ubuntu-latest"
+          - name: raspberrypi
             runs_on: "ubuntu-24.04-arm"
     runs-on: ${{ matrix.molecule_distro.runs_on }}
     steps:
@@ -55,6 +54,4 @@ jobs:
           molecule --version &&
           ansible --version &&
           MOLECULE_COMMAND=${{ matrix.molecule_distro.command }}
-          MOLECULE_PLATFORM=${{ matrix.molecule_distro.platform }}
-          MOLECULE_DISTRO=${{ matrix.molecule_distro.distro }}
-          molecule test
+          molecule test -s ${{ matrix.molecule_distro.name }}
diff --git a/molecule/default/Dockerfile.archlinux.j2 b/molecule/archlinux/Dockerfile.j2
index 1d5a1cd5..1d5a1cd5 100644
--- a/molecule/default/Dockerfile.archlinux.j2
+++ b/molecule/archlinux/Dockerfile.j2
diff --git a/molecule/archlinux/converge.yml b/molecule/archlinux/converge.yml
new file mode 100644
index 00000000..228ab6d9
--- /dev/null
+++ b/molecule/archlinux/converge.yml
@@ -0,0 +1,33 @@
+---
+- name: Converge
+  hosts: archlinux
+  gather_facts: true
+  vars:
+    ansible_become_method: su
+    user_public_keys:
+      - "ssh-ed25519 AAAA...fMo"
+      - "ssh-rsa AAAA...4I3"
+    user_groups: ["wheel", "test_group"]
+    locales:
+      - "en_US.UTF-8 UTF-8"
+    timezone: "GMT"
+
+    python_global_version: "3.13"
+    python_versions:
+      - "3.13"
+  roles:
+    - role: "hostname"
+    - role: "network"
+    - role: "user"
+    - role: "ssh"
+    - role: "password_policy"
+    - role: "locales"
+    - role: "timezone"
+    - role: "wireguard"
+    - role: "wireguard_gateway"
+    - role: "homebrew"
+    - role: "python"
+    - role: "go"
+    - role: "docker"
+    - role: "podman"
+    - role: "ansible"
diff --git a/molecule/default/molecule.yml b/molecule/archlinux/molecule.yml
index c0ec4e96..9fdd7912 100644
--- a/molecule/default/molecule.yml
+++ b/molecule/archlinux/molecule.yml
@@ -7,10 +7,9 @@ dependency:
 driver:
   name: podman
 platforms:
-  - name: instance
-    image: ${MOLECULE_DISTRO:-archlinux}
-    dockerfile: Dockerfile.${MOLECULE_DISTRO:-archlinux}.j2
-    platform: "${MOLECULE_PLATFORM:-linux/amd64}"
+  - name: archlinux
+    dockerfile: Dockerfile.j2
+    platform: "linux/amd64"
     pre_build_image: false
     privileged: true
     command: ${MOLECULE_COMMAND:-"/lib/systemd/systemd"}
@@ -20,6 +19,7 @@ platforms:
     volumes:
       - "/sys/fs/cgroup:/sys/fs/cgroup:rw"
     cgroupns_mode: host
+
 provisioner:
   name: ansible
   inventory:
@@ -27,7 +27,6 @@ provisioner:
       host_vars: "../../host_vars/"
       group_vars: "../../group_vars/"
   env:
-    MOLECULE_DISTRO: "${MOLECULE_DISTRO:-archlinux}"
     ANSIBLE_ROLES_PATH: "../../roles"
   config_options:
     defaults:
diff --git a/molecule/default/Dockerfile.raspberrypi.j2 b/molecule/debian/Dockerfile.j2
index aa620c58..aa620c58 100644
--- a/molecule/default/Dockerfile.raspberrypi.j2
+++ b/molecule/debian/Dockerfile.j2
diff --git a/molecule/debian/converge.yml b/molecule/debian/converge.yml
new file mode 100644
index 00000000..af91e143
--- /dev/null
+++ b/molecule/debian/converge.yml
@@ -0,0 +1,33 @@
+---
+- name: Converge
+  hosts: debian
+  gather_facts: true
+  vars:
+    ansible_become_method: su
+    user_public_keys:
+      - "ssh-ed25519 AAAA...fMo"
+      - "ssh-rsa AAAA...4I3"
+    user_groups: ["wheel", "test_group"]
+    locales:
+      - "en_US.UTF-8 UTF-8"
+    timezone: "GMT"
+
+    python_global_version: "3.13"
+    python_versions:
+      - "3.13"
+  roles:
+    - role: "hostname"
+    - role: "network"
+    - role: "user"
+    - role: "ssh"
+    - role: "password_policy"
+    - role: "locales"
+    - role: "timezone"
+    - role: "wireguard"
+    - role: "wireguard_gateway"
+    - role: "homebrew"
+    - role: "python"
+    - role: "go"
+    - role: "docker"
+    - role: "podman"
+    - role: "ansible"
diff --git a/molecule/debian/molecule.yml b/molecule/debian/molecule.yml
new file mode 100644
index 00000000..e549997a
--- /dev/null
+++ b/molecule/debian/molecule.yml
@@ -0,0 +1,40 @@
+---
+role_name_check: 1
+dependency:
+  name: galaxy
+  options:
+    ignore-errors: true
+driver:
+  name: podman
+platforms:
+  - name: debian
+    dockerfile: Dockerfile.j2
+    platform: "linux/amd64"
+    pre_build_image: false
+    privileged: true
+    command: ${MOLECULE_COMMAND:-"/lib/systemd/systemd"}
+    tmpfs:
+      "/tmp": "rw"
+      "/run": "rw,exec"
+    volumes:
+      - "/sys/fs/cgroup:/sys/fs/cgroup:rw"
+    cgroupns_mode: host
+
+provisioner:
+  name: ansible
+  inventory:
+    links:
+      host_vars: "../../host_vars/"
+      group_vars: "../../group_vars/"
+  env:
+    ANSIBLE_ROLES_PATH: "../../roles"
+  config_options:
+    defaults:
+      callback_result_format: yaml
+      interpreter_python: /usr/bin/python3
+    ssh_connection:
+      pipelining: true
+  playbooks:
+    converge: converge.yml
+verifier:
+  name: ansible
diff --git a/molecule/default/converge.yml b/molecule/default/converge.yml
deleted file mode 100644
index c435c56d..00000000
--- a/molecule/default/converge.yml
+++ /dev/null
@@ -1,52 +0,0 @@
----
-- name: Converge
-  hosts: instance
-  gather_facts: true
-  vars:
-    ansible_become_method: su
-    network_wifi_ssid: "TEST_WIFI_SSID"
-    network_wifi_pass: "TEST_WIFI_PASS"
-    username: test_user
-    user_public_keys:
-      - "ssh-ed25519 AAAA...fMo"
-      - "ssh-rsa AAAA...4I3"
-    user_groups: ["wheel", "test_group"]
-    ssh_port: 1337
-    locales:
-      - "en_US.UTF-8 UTF-8"
-    timezone: "GMT"
-    python_global_version: "3.13"
-    python_versions:
-      - "3.13"
-    pihole_interface: "eth0"
-    pihole_domain: "pi.hole"
-    wireguard_connections:
-      protonvpn-example: |
-        [Interface]
-        PrivateKey = your_private_key_here
-        Address = 10.2.0.2/32
-        DNS = 10.2.0.1
-
-        [Peer]
-        PublicKey = server_public_key
-        AllowedIPs = 0.0.0.0/0
-        Endpoint = example.protonvpn.com:51820
-  roles:
-    - role: "network"
-    - role: "user"
-    - role: "ssh"
-    - role: "password_policy"
-    - role: "locales"
-    - role: "timezone"
-    - role: "homebrew"
-    - role: "python"
-    - role: "go"
-    - role: "docker"
-    - role: "podman"
-    - role: "ansible"
-    - role: "wireguard"
-    - role: "wireguard_gateway"
-    - role: "pihole"
-      when:
-        - lookup('ansible.builtin.env', 'MOLECULE_DISTRO') == 'ubuntu' or
-          lookup('ansible.builtin.env', 'MOLECULE_DISTRO') == 'raspberrypi'
diff --git a/molecule/raspberrypi/Dockerfile.j2 b/molecule/raspberrypi/Dockerfile.j2
new file mode 100644
index 00000000..aa620c58
--- /dev/null
+++ b/molecule/raspberrypi/Dockerfile.j2
@@ -0,0 +1,25 @@
+# Based on the amazing work of geerlingguy <3
+# FROM docker.io/geerlingguy/docker-debian12-ansible
+FROM docker.io/library/debian:bookworm
+
+ARG DEBIAN_FRONTEND=noninteractive
+
+ENV container docker
+
+RUN apt-get update \
+    && apt-get install -y --no-install-recommends \
+        systemd python3 avahi-daemon iproute2 ifupdown \
+    && rm -Rf /var/lib/apt/lists/* \
+    && rm -Rf /usr/share/doc \
+    && rm -Rf /usr/share/man \
+    && apt-get clean
+
+RUN rm -f /lib/systemd/system/multi-user.target.wants/getty.target
+
+# Mimic Raspberry OS default boot (for testing)
+RUN systemctl enable avahi-daemon \
+    && touch /etc/locale.gen
+
+VOLUME ["/sys/fs/cgroup", "/tmp", "/run", "/opt"]
+
+CMD ["/lib/systemd/systemd"]
diff --git a/molecule/raspberrypi/converge.yml b/molecule/raspberrypi/converge.yml
new file mode 100644
index 00000000..0b6ef857
--- /dev/null
+++ b/molecule/raspberrypi/converge.yml
@@ -0,0 +1,28 @@
+---
+- name: Converge
+  hosts: raspberrypi
+  gather_facts: true
+  vars:
+    ansible_become_method: su
+    user_groups: ["wheel", "test_group"]
+    locales:
+      - "en_US.UTF-8 UTF-8"
+    timezone: "GMT"
+    pihole_interface: "eth0"
+    pihole_domain: "pi.hole"
+    pihole_totp_secret: "CHANGEME"
+    pihole_password: "{{ ('changeme' | hash('sha256') | hash('sha256'))[:64] }}"
+    pihole_dhcp_enabled: false
+    wireguard_gateway_enabled: true
+    wireguard_autostart_connection: "protonvpn-us-1"
+  roles:
+    - role: "hostname"
+    - role: "network"
+    - role: "user"
+    - role: "ssh"
+    - role: "password_policy"
+    - role: "locales"
+    - role: "timezone"
+    - role: "wireguard"
+    - role: "wireguard_gateway"
+    - role: "pihole"
diff --git a/molecule/raspberrypi/molecule.yml b/molecule/raspberrypi/molecule.yml
new file mode 100644
index 00000000..a1d57df3
--- /dev/null
+++ b/molecule/raspberrypi/molecule.yml
@@ -0,0 +1,40 @@
+---
+role_name_check: 1
+dependency:
+  name: galaxy
+  options:
+    ignore-errors: true
+driver:
+  name: podman
+platforms:
+  - name: raspberrypi
+    dockerfile: Dockerfile.j2
+    platform: "linux/arm64/v8"
+    pre_build_image: false
+    privileged: true
+    command: ${MOLECULE_COMMAND:-"/lib/systemd/systemd"}
+    tmpfs:
+      "/tmp": "rw"
+      "/run": "rw,exec"
+    volumes:
+      - "/sys/fs/cgroup:/sys/fs/cgroup:rw"
+    cgroupns_mode: host
+
+provisioner:
+  name: ansible
+  inventory:
+    links:
+      host_vars: "../../host_vars/"
+      group_vars: "../../group_vars/"
+  env:
+    ANSIBLE_ROLES_PATH: "../../roles"
+  config_options:
+    defaults:
+      callback_result_format: yaml
+      interpreter_python: /usr/bin/python3
+    ssh_connection:
+      pipelining: true
+  playbooks:
+    converge: converge.yml
+verifier:
+  name: ansible
diff --git a/molecule/default/Dockerfile.ubuntu.j2 b/molecule/ubuntu/Dockerfile.j2
index 37199b55..37199b55 100644
--- a/molecule/default/Dockerfile.ubuntu.j2
+++ b/molecule/ubuntu/Dockerfile.j2
diff --git a/molecule/ubuntu/converge.yml b/molecule/ubuntu/converge.yml
new file mode 100644
index 00000000..e80d8441
--- /dev/null
+++ b/molecule/ubuntu/converge.yml
@@ -0,0 +1,33 @@
+---
+- name: Converge
+  hosts: ubuntu
+  gather_facts: true
+  vars:
+    ansible_become_method: su
+    user_public_keys:
+      - "ssh-ed25519 AAAA...fMo"
+      - "ssh-rsa AAAA...4I3"
+    user_groups: ["wheel", "test_group"]
+    locales:
+      - "en_US.UTF-8 UTF-8"
+    timezone: "GMT"
+
+    python_global_version: "3.13"
+    python_versions:
+      - "3.13"
+  roles:
+    - role: "hostname"
+    - role: "network"
+    - role: "user"
+    - role: "ssh"
+    - role: "password_policy"
+    - role: "locales"
+    - role: "timezone"
+    - role: "wireguard"
+    - role: "wireguard_gateway"
+    - role: "homebrew"
+    - role: "python"
+    - role: "go"
+    - role: "docker"
+    - role: "podman"
+    - role: "ansible"
diff --git a/molecule/ubuntu/molecule.yml b/molecule/ubuntu/molecule.yml
new file mode 100644
index 00000000..a034f7fb
--- /dev/null
+++ b/molecule/ubuntu/molecule.yml
@@ -0,0 +1,40 @@
+---
+role_name_check: 1
+dependency:
+  name: galaxy
+  options:
+    ignore-errors: true
+driver:
+  name: podman
+platforms:
+  - name: ubuntu
+    dockerfile: Dockerfile.j2
+    platform: "linux/amd64"
+    pre_build_image: false
+    privileged: true
+    command: ${MOLECULE_COMMAND:-"/lib/systemd/systemd"}
+    tmpfs:
+      "/tmp": "rw"
+      "/run": "rw,exec"
+    volumes:
+      - "/sys/fs/cgroup:/sys/fs/cgroup:rw"
+    cgroupns_mode: host
+
+provisioner:
+  name: ansible
+  inventory:
+    links:
+      host_vars: "../../host_vars/"
+      group_vars: "../../group_vars/"
+  env:
+    ANSIBLE_ROLES_PATH: "../../roles"
+  config_options:
+    defaults:
+      callback_result_format: yaml
+      interpreter_python: /usr/bin/python3
+    ssh_connection:
+      pipelining: true
+  playbooks:
+    converge: converge.yml
+verifier:
+  name: ansible