- name: Create CA directory
  delegate_to: "localhost"
  run_once: true
  ansible.builtin.file:
    path: "ca"
    state: "directory"
    mode: "0700"

- name: Create private key with password protection
  delegate_to: "localhost"
  run_once: true
  community.crypto.openssl_privatekey:
    path: "ca/ca-certificate.key"
    passphrase: "{{ local_ca_passphrase }}"
    size: "{{ local_ca_key_size }}"
    type: "{{ local_ca_key_type }}"
    mode: "0640"

- name: Create certificate signing request (CSR) for CA certificate
  delegate_to: "localhost"
  run_once: true
  community.crypto.openssl_csr:
    path: "ca/ca-certificate.csr"
    privatekey_path: "ca/ca-certificate.key"
    privatekey_passphrase: "{{ vault.ca.passphrase }}"
    common_name: "{{ local_ca_common_name }}"
    use_common_name_for_san: false  # since we do not specify SANs, don't use CN as a SAN
    country_name: "{{ local_ca_country_name }}"
    locality_name: "{{ local_ca_locality_name }}"
    organization_name: "{{ local_ca_organization_name }}"
    email_address: "{{ local_ca_email_address }}"
    basic_constraints:
      - "CA:TRUE"
    basic_constraints_critical: true
    key_usage:
      - "keyCertSign"
    key_usage_critical: true
    return_content: true
  register: local_ca_csr

- name: Create self-signed CA certificate from CSR
  delegate_to: "localhost"
  run_once: true
  # noqa: no-handler
  when: "local_ca_csr.changed"
  community.crypto.x509_certificate:
    path: "ca/ca-certificate.crt"
    csr_content: "{{ local_ca_csr.csr }}"
    privatekey_path: "ca/ca-certificate.key"
    privatekey_passphrase: "{{ vault.ca.passphrase }}"
    provider: "selfsigned"