---
- name: Determine whether to force private key regeneration (1/2)
  set_fact:
    acme_certificate_INTERNAL_force_regenerate_private_key: no

- name: Determine whether to force private key regeneration (2/2)
  set_fact:
    acme_certificate_INTERNAL_force_regenerate_private_key: yes
  tags:
  - issue-tls-certs-newkey

- block:
  - name: Ansible version check
    assert:
      that: "ansible_version.string is version('2.8.3', '>=')"
      msg: "This version of the acme-certificate role must be used with Ansible 2.8.3 or later."
    run_once: yes

  - name: Sanity checks
    assert:
      that: "acme_certificate_challenge != 'dns-01' or acme_certificate_dns_provider is not undefined"
      msg: "acme_certificate_dns_provider must be defined for dns-01 DNS challenge"
    run_once: yes

  - name: "Test whether old certificate files for domains {{ ', '.join(acme_certificate_domains) }} exist"
    stat:
      path: "{{ [acme_certificate_keys_path, acme_certificate_key_name] | path_join }}.pem"
    delegate_to: localhost
    register: acme_certificate_INTERNAL_old_certificate_exists
    when: "acme_certificate_keys_old_store"
    run_once: yes

  - name: "Copying old certificate files for domains {{ ', '.join(acme_certificate_domains) }}"
    copy:
      src: "{{ [acme_certificate_keys_path, acme_certificate_key_name] | path_join }}{{ item }}"
      dest: >-
        {{ [
          acme_certificate_keys_old_path,
          (
            (ansible_date_time.date ~ '-' ~ ansible_date_time.hour ~ ansible_date_time.minute ~ ansible_date_time.second ~ '-')
            if acme_certificate_keys_old_prepend_timestamp else ''
          ) ~ acme_certificate_key_name ~ item
        ] | path_join }}
    delegate_to: localhost
    with_items:
    - "-chain.pem"
    - "-fullchain.pem"
    - "-rootchain.pem"
    - "-root.pem"
    - ".key"
    - ".pem"
    when: "acme_certificate_keys_old_store and acme_certificate_INTERNAL_old_certificate_exists.stat.exists"
    run_once: yes

  tags:
  - issue-tls-certs-newkey
  - issue-tls-certs

- block:
  - name: "Creating private key for domains {{ ', '.join(acme_certificate_domains) }} (RSA)"
    openssl_privatekey:
      path: "{{ [acme_certificate_keys_path, acme_certificate_key_name ~ '.key'] | path_join }}"
      mode: "{{ acme_certificate_privatekey_mode }}"
      type: "{{ 'RSA' if acme_certificate_algorithm == 'rsa' else 'ECC' }}"
      size: "{{ acme_certificate_key_length if acme_certificate_algorithm == 'rsa' else omit }}"
      curve: >-
        {{ omit if acme_certificate_algorithm == 'rsa' else
           'secp256r1' if acme_certificate_algorithm == 'p-256' else
           'secp384r1' if acme_certificate_algorithm == 'p-384' else
           'secp521r1' if acme_certificate_algorithm == 'p-521' else
           'invalid value for acme_certificate_algorithm!' }}
      force: "{{ acme_certificate_INTERNAL_force_regenerate_private_key }}"
    delegate_to: localhost
    run_once: yes

  - name: "Creating CSR for domains {{ ', '.join(acme_certificate_domains) }}"
    openssl_csr:
      path: "{{ [acme_certificate_keys_path, acme_certificate_key_name ~ '.csr'] | path_join }}"
      privatekey_path: "{{ [acme_certificate_keys_path, acme_certificate_key_name ~ '.key'] | path_join }}"
      subject_alt_name: |
          {{ acme_certificate_domains | map('regex_replace', '^(.*)$', 'DNS:\1' ) | list }}
      ocsp_must_staple: "{{ acme_certificate_ocsp_must_staple }}"
      use_common_name_for_san: no
      force: yes
    delegate_to: localhost
    run_once: yes

  - name: "Get root certificate for domains {{ ', '.join(acme_certificate_domains) }}"
    get_url:
      url: "{{ acme_certificate_root_certificate }}"
      dest: "{{ [acme_certificate_keys_path, acme_certificate_key_name ~ '-root.pem'] | path_join }}"
      force: yes
      validate_certs: "{{ acme_certificate_validate_certs }}"
    delegate_to: localhost
    run_once: yes

  - block:
    - name: "Preparing challenges for domains {{ ', '.join(acme_certificate_domains) }}"
      acme_certificate:
        account_key: "{{ acme_certificate_acme_account }}"
        modify_account: "{{ acme_certificate_modify_account }}"
        csr: "{{ [acme_certificate_keys_path, acme_certificate_key_name ~ '.csr'] | path_join }}"
        dest: "{{ [acme_certificate_keys_path, acme_certificate_key_name ~ '.pem'] | path_join }}"
        fullchain_dest: "{{ [acme_certificate_keys_path, acme_certificate_key_name ~ '-fullchain.pem'] | path_join }}"
        chain_dest: "{{ [acme_certificate_keys_path, acme_certificate_key_name ~ '-chain.pem'] | path_join }}"
        account_email: "{{ acme_certificate_acme_email }}"
        terms_agreed: "{{ acme_certificate_terms_agreed }}"
        challenge: "{{ acme_certificate_challenge }}"
        acme_directory: "{{ acme_certificate_acme_directory }}"
        acme_version: "{{ acme_certificate_acme_version }}"
        force: yes
        validate_certs: "{{ acme_certificate_validate_certs }}"
      delegate_to: localhost
      run_once: yes
      register: acme_certificate_INTERNAL_challenge

    always:
    - debug:
        msg: >-
          account URI: {{ acme_certificate_INTERNAL_challenge.get('account_uri') }};
          order URI: {{ acme_certificate_INTERNAL_challenge.get('order_uri') }}
      run_once: yes

  - block:
    # Set up HTTP challenges
    - include_tasks: http-create.yml
      when: "acme_certificate_challenge == 'http-01'"

    # Set up DNS challenges
    - include_tasks: dns-{{ acme_certificate_dns_provider }}-create.yml
      when: "acme_certificate_challenge == 'dns-01'"

    - name: "Getting certificates for domains {{ ', '.join(acme_certificate_domains) }}"
      acme_certificate:
        account_key: "{{ acme_certificate_acme_account }}"
        modify_account: "{{ acme_certificate_modify_account }}"
        csr: "{{ [acme_certificate_keys_path, acme_certificate_key_name ~ '.csr'] | path_join }}"
        dest: "{{ [acme_certificate_keys_path, acme_certificate_key_name ~ '.pem'] | path_join }}"
        fullchain_dest: "{{ [acme_certificate_keys_path, acme_certificate_key_name ~ '-fullchain.pem'] | path_join }}"
        chain_dest: "{{ [acme_certificate_keys_path, acme_certificate_key_name ~ '-chain.pem'] | path_join }}"
        account_email: "{{ acme_certificate_acme_email }}"
        terms_agreed: "{{ acme_certificate_terms_agreed }}"
        challenge: "{{ acme_certificate_challenge }}"
        acme_directory: "{{ acme_certificate_acme_directory }}"
        acme_version: "{{ acme_certificate_acme_version }}"
        force: yes
        data: "{{ acme_certificate_INTERNAL_challenge }}"
        deactivate_authzs: "{{ acme_certificate_deactivate_authzs }}"
        validate_certs: "{{ acme_certificate_validate_certs }}"
      delegate_to: localhost
      run_once: yes

    - name: "Form root chain for domains {{ ', '.join(acme_certificate_domains) }}"
      copy:
        dest: "{{ [acme_certificate_keys_path, acme_certificate_key_name ~ '-rootchain.pem'] | path_join }}"
        content: |
          {{ lookup('file', [acme_certificate_keys_path, acme_certificate_key_name ~ '-root.pem'] | path_join) }}
          {{ lookup('file', [acme_certificate_keys_path, acme_certificate_key_name ~ '-chain.pem'] | path_join) }}
      delegate_to: localhost
      run_once: yes
    always:
    # Clean up HTTP challenges
    - include_tasks: http-cleanup.yml
      when: "acme_certificate_challenge == 'http-01'"

    # Clean up DNS challenges
    - include_tasks: dns-{{ acme_certificate_dns_provider }}-cleanup.yml
      when: "acme_certificate_challenge == 'dns-01'"

    when: acme_certificate_INTERNAL_challenge is changed

  tags:
  - issue-tls-certs-newkey
  - issue-tls-certs

- name: "Verifying certificate for domains {{ ', '.join(acme_certificate_domains) }}"
  command: >-
    openssl verify
    -CAfile "{{ [acme_certificate_keys_path, acme_certificate_key_name ~ '-root.pem'] | path_join }}"
    -untrusted "{{ [acme_certificate_keys_path, acme_certificate_key_name ~ '-chain.pem'] | path_join }}"
    "{{ [acme_certificate_keys_path, acme_certificate_key_name ~ '.pem'] | path_join }}"
  changed_when: no
  delegate_to: localhost
  run_once: yes
  ignore_errors: "{{ not acme_certificate_verify_certs }}"
  tags:
  - issue-tls-certs-newkey
  - issue-tls-certs
  - verify-tls-certs