- hosts: all
  roles:
    - ensure-docker
    - ensure-skopeo

  tasks:
    # This happens in the pre-playbook of the
    # opendev-buildset-registry job.  Since we're testing these roles
    # in opendev, and we're running a second buildset registry, we
    # need to do the same here for it.
    - name: Open the IPv4 port for the second buildset registry
      become: true
      iptables:
        action: insert
        chain: openstack-INPUT
        destination_port: '9000'
        jump: ACCEPT
        match: tcp
        ctstate: NEW
        protocol: tcp
        ip_version: ipv4
    - name: Open the IPv6 port for the second buildset registry
      become: true
      iptables:
        action: insert
        chain: openstack-INPUT
        destination_port: '9000'
        jump: ACCEPT
        match: tcp
        ctstate: NEW
        protocol: tcp
        ip_version: ipv6