---
- name: Generate certificates
  hosts: localhost
  gather_facts: false

  tasks:
  - name: Run generate-certificates.sh
    command: >
      /bin/bash
      generate-certificates.sh create
      "{{ groups.ipareplicas[0] }}"
      "{{ ipareplica_domain | default(groups.ipareplicas[0].split('.')[1:] | join ('.')) }}"
    args:
      chdir: "{{ playbook_dir }}"

- name: Test ipareplicas installation without CA
  hosts: ipareplicas
  become: true

  vars:
    # Root CA certificate
    ipareplica_ca_cert_files:
      - /root/ca-less-test/ca.crt
    # Directory server certificates
    ipareplica_dirsrv_cert_name: dirsrv-cert
    ipareplica_dirsrv_cert_files:
      - /root/ca-less-test/dirsrv.p12
    ipareplica_dirsrv_pin: SomePKCS12password
    # Apache certificates
    ipareplica_http_cert_name: httpd-cert
    ipareplica_http_cert_files:
      - /root/ca-less-test/httpd.p12
    ipareplica_http_pin: SomePKCS12password
    # PKINIT configuration
    ipareplica_no_pkinit: no
    ipareplica_pkinit_cert_name: pkinit-cert
    ipareplica_pkinit_cert_files:
      - /root/ca-less-test/pkinit.p12
    ipareplica_pkinit_pin: SomePKCS12password

  pre_tasks:
    - name: Remove "/root/ca-less-test"
      file:
        path: "/root/ca-less-test"
        state: absent

    - name: Generate "/root/ca-less-test"
      file:
        path: "/root/ca-less-test"
        state: directory

    - name: Copy CA certificate
      copy:
        src: "{{ playbook_dir }}/certificates/root-ca/cert.pem"
        dest: "/root/ca-less-test/ca.crt"
        owner: root
        group: root
        mode: "0644"

    - name: Copy p12 certificates
      copy:
        src: "{{ playbook_dir }}/certificates/{{ item }}/{{ groups.ipareplicas[0] }}/cert.p12"
        dest: "/root/ca-less-test/{{ item }}.p12"
        owner: root
        group: root
        mode: "0644"
      with_items:
        - dirsrv
        - httpd
        - pkinit

  roles:
    - role: ipareplica
      state: present

  post_tasks:
    - name: Fix KDC certificate permissions
      file:
        path: /var/kerberos/krb5kdc/kdc.crt
        owner: root
        group: root
        mode: '0644'