Make check mode more usable.

This skips several tasks that fail, at least in some conditions, when
run in check mode but not when run in normal mode.

roles/ferm/README.md

+## Optional variables
+* `ferm_skip_conflicts_in_check_mode`: Setting this to true will cause this role
+  to skip the check for conflicting firewall managers when run in check mode.
+  This is useful if another role would have removed them. (default: false)

roles/ferm/defaults/main.yml

+---
+
+ferm_skip_conflicts_in_check_mode: false

roles/ferm/tasks/main.yml

@@ -41,6 +41,7 @@
          and ansible_facts.services['firewalld.service'].state != 'running'"
     fail_msg: "A conflicting firewall manager appears to be enabled. Remove it
                before continuing."
+  when: not ferm_skip_conflicts_in_check_mode or not ansible_check_mode
 
 - name: Install ferm.
   block:
@@ -69,11 +70,13 @@
       dest: "{{ tmpdir.path }}"
       src: /usr/local/src/{{ ferm_url | basename }}
       remote_src: true
+    when: tmpdir.path is defined
 
   - name: Install ferm.
     command:
       cmd: make PREFIX=/usr/local install
       chdir: "{{ tmpdir.path }}/ferm-{{ ferm_version }}"
+    when: tmpdir.path is defined
 
   - name: Correct paths in unit file.
     command:
@@ -84,6 +87,7 @@
     file:
       path: "{{ tmpdir.path }}"
       state: absent
+    when: tmpdir.path is defined
   when: ferm_installed.rc
 
 - name: Install base ferm configuration.

roles/lockss/tasks/firewall.yml

@@ -17,6 +17,8 @@
   import_role:
     name: ferm
     allow_duplicates: false
+  vars:
+    ferm_skip_conflicts_in_check_mode: true
 
 - name: Add ferm rules for LOCKSS.
   template:

roles/lockss/tasks/main.yml

@@ -125,6 +125,7 @@
     depth: 1
   become: true
   become_user: lockss
+  when: not ansible_check_mode
 
 - name: Install ifconfig.
   package:
@@ -167,6 +168,7 @@
     chdir: /usr/src/lockss
   become: true
   become_user: lockss
+  when: not ansible_check_mode
 
 - name: Add Docker secret for UI password.
   vars:
@@ -208,6 +210,7 @@
     chdir: /usr/src/lockss
   become: true
   become_user: lockss
+  when: not ansible_check_mode
 
 # FIXME: LOCKSS's scripts are yucky. Should we care?
 - name: Stop running LOCKSS containers.
@@ -216,6 +219,7 @@
     chdir: /usr/src/lockss
   become: true
   become_user: lockss
+  when: not ansible_check_mode
 
 - name: Assemble LOCKSS containers.
   command:
@@ -223,6 +227,7 @@
     chdir: /usr/src/lockss
   become: true
   become_user: lockss
+  when: not ansible_check_mode
 
 - name: Deploy LOCKSS containers.
   command:
@@ -230,3 +235,4 @@
     chdir: /usr/src/lockss
   become: true
   become_user: lockss
+  when: not ansible_check_mode