- name: Create consul policy for Caddy TLS and rate limit
  delegate_to: "{{ caddy_consul_delegate_to }}"
  run_once: true
  community.general.consul_policy:
    token: "{{ caddy_consul_admin_token }}"
    name: "caddy"
    rules: |
      key_prefix "caddy-{{ caddy_my_name }}-tls" {
        policy = "write"
      }
      key_prefix "caddy-{{ caddy_my_name }}-rl" {
        policy = "write"
      }
      session_prefix "" {
        policy = "write"
      }
      node_prefix "" {
        policy = "read"
      }
      agent_prefix "" {
        policy = "read"
      }

- name: Create/retrieve Consul Caddy accessor_id
  ansible.builtin.shell:
    executable: "/usr/bin/bash"
    cmd: |
      set -o pipefail
      if test -f /root/.consul_caddy_accessor_id; then
        echo OK
      else
        uuidgen > /root/.consul_caddy_accessor_id
        echo CHANGED
      fi
      cat /root/.consul_caddy_accessor_id
  register: "consul_out_caddy_accessor_id"
  changed_when: "consul_out_caddy_accessor_id.stdout_lines[0] == 'CHANGED'"

- name: Create/retrieve consul token
  delegate_to: "{{ caddy_consul_delegate_to }}"
  community.general.consul_token:
    token: "{{ caddy_consul_admin_token }}"
    accessor_id: "{{ consul_out_caddy_accessor_id.stdout_lines[1] }}"
    description: "Caddy {{ caddy_my_name }} {{ ansible_fqdn }}"
    policies:
      - name: "caddy"
  register: "caddy_out_consul_token"