- name: Install requirements
  ansible.builtin.apt:
    name:
      - "ssl-cert"

- name: Copy CA certificate file on server
  ansible.builtin.copy:
    src: "ca/ca-certificate.crt"
    dest: "/etc/ssl/certs/local-ca.crt"
    mode: "0644"

- name: Create private key for new certificate
  community.crypto.openssl_privatekey:
    path: "/etc/ssl/private/local.key"
    mode: "0640"
    group: "ssl-cert"

- name: Create CSR for new certificate
  community.crypto.openssl_csr:
    path: "/etc/ssl/certs/local.csr"
    privatekey_path: "/etc/ssl/private/local.key"
    common_name: "{{ cert_domains[0] }}"
    subject_alt_name: "{{ cert_domains }}"
    country_name: "{{ cert_country_name }}"
    locality_name: "{{ cert_locality_name }}"
    organization_name: "{{ cert_organization_name }}"
    email_address: "{{ cert_email_address }}"
    return_content: true
  register: cert_csr

- name: Sign certificate with our CA
  delegate_to: "localhost"
  # noqa: no-handler
  when: "cert_csr.changed"
  community.crypto.x509_certificate_pipe:
    csr_content: "{{ cert_csr.csr }}"
    provider: "ownca"
    ownca_path: "ca/ca-certificate.crt"
    ownca_privatekey_path: "ca/ca-certificate.key"
    ownca_privatekey_passphrase: "{{ vault.ca.passphrase }}"
    ownca_not_after: "{{ cert_not_after }}"
    ownca_not_before: "{{ cert_not_before }}"
  register: cert_certificate

- name: Write certificate file on server
  # noqa: no-handler
  when: "cert_csr.changed"
  ansible.builtin.copy:
    dest: "/etc/ssl/certs/local.crt"
    content: "{{ cert_certificate.certificate }}"
    mode: "0644"
  notify:
    - "Reboot host"