---
- name: Create CAcert group
  ansible.builtin.group:
    name: "{{ cacert_os_group }}"
    state: present
    system: true

- name: Create CAcert user
  ansible.builtin.user:
    name: "{{ cacert_os_user }}"
    group: "{{ cacert_os_group }}"
    home: "{{ cacert_home }}"
    state: present
    system: true

- name: Create CAcert directories
  ansible.builtin.file:
    path: "{{ cacert_home }}/{{ item.path }}"
    owner: "{{ cacert_os_user }}"
    group: "{{ cacert_os_group }}"
    mode: "{{ item.mode }}"
    state: directory
  loop:
    - { path: etc, mode: '0750' }
    - { path: bin, mode: '0750' }
    - { path: download, mode: '0750' }

- name: Copy IDP binary
  ansible.builtin.copy:
    src: ../oidc_idp/cacert-idp
    dest: "{{ cacert_home }}/bin/cacert-idp"
    owner: root
    group: "{{ cacert_os_group }}"
    mode: "0750"

- name: Check whether certificate exists
  ansible.builtin.stat:
    path: "{{ idp_tls.cert }}"
  register: idp_cert_st

- name: Create IDP key and certificate with mkcert
  block:

    - name: Create temporary directory for IDP key and certificate
      ansible.builtin.tempfile:
        prefix: "idp-cert."
        state: directory
      register: idp_cert_temp_dir

    - name: Create IDP key and certificate
      ansible.builtin.command:
        cmd: "mkcert -cert-file {{ idp_cert_temp_dir.path }}/idp.pem -key-file {{ idp_cert_temp_dir.path }}/idp.key.pem {{ oidc_urls.idp.host }}"
      environment:
        CAROOT: "{{ mkcert_caroot | default('') }}"

    - name: Move IDP certificate and key to target
      ansible.builtin.copy:
        src: "{{ idp_cert_temp_dir.path }}/{{ item.src }}"
        dest: "{{ item.dest }}"
        owner: root
        group: "{{ cacert_os_group }}"
        mode: "{{ item.mode }}"
        remote_src: true
      loop:
        - {src: idp.pem, dest: "{{ idp_tls.cert }}", mode: '0644'}
        - {src: idp.key.pem, dest: "{{ idp_tls.key }}", mode: '0640'}
      become: true

    - name: Remove temporary directory
      ansible.builtin.file:
        path: "{{ idp_cert_temp_dir.path }}"
        state: absent

  when: not idp_cert_st.stat.exists
  become: false

- name: Copy client CA certificates
  ansible.builtin.copy:
    dest: "{{ idp_tls.client_cas }}"
    owner: root
    group: "{{ cacert_os_group }}"
    mode: '0640'
    content: "{{ idp.client_certificate_data }}"

- name: Check whether configuration file exists
  ansible.builtin.stat:
    path: "{{ cacert_home }}/etc/cacert-idp.toml"
  register: idp_config_st

- name: Get credentials from existing file
  block:

    - name: fetch existing configuration file
      ansible.builtin.fetch:
        src: "{{ idp_config_st.stat.path }}"
        dest: idp_config-from-vagrant.toml
        flat: true

    - name: set credential facts
      ansible.builtin.set_fact:
        idp_csrf_key: "{{ lookup('ansible.builtin.ini', 'csrf.key', section='security', file='idp_config-from-vagrant.toml') | from_json }}"
        idp_auth_key: "{{ lookup('ansible.builtin.ini', 'auth-key', section='session', file='idp_config-from-vagrant.toml') | from_json }}"
        idp_enc_key: "{{ lookup('ansible.builtin.ini', 'enc-key', section='session', file='idp_config-from-vagrant.toml') | from_json }}"
      ignore_errors: true

  when: idp_config_st.stat.exists

- name: Create IDP configuration
  ansible.builtin.template:
    src: idp_config.toml.j2
    dest: "{{ cacert_home }}/etc/cacert-idp.toml"
    owner: root
    group: "{{ cacert_os_group }}"
    mode: '0640'
  notify: idp_systemd_reload

- name: Create IDP systemd unit file
  ansible.builtin.template:
    src: cacert-idp.service.j2
    dest: /etc/systemd/system/cacert-idp.service
    owner: root
    group: root
    mode: "0644"
  notify: idp_systemd_reload

- name: Ensure service is started
  ansible.builtin.systemd:
    state: started
    name: cacert-idp
    enabled: true