---
# file: roles/step-ca/tasks/main.yml

- name: Create step-ca base directory
  ansible.builtin.file:
    path: "{{ stepca_base_dir }}"
    state: directory
    owner: root
    group: root
    mode: "0755"

- name: Create step-ca data directory
  ansible.builtin.file:
    path: "{{ stepca_data_dir }}"
    state: directory
    owner: "1000"
    group: "1000"
    mode: "0755"

- name: Create Docker network for step-ca
  community.docker.docker_network:
    name: "{{ stepca_docker_network }}"
    state: present

- name: Deploy step-ca compose file
  ansible.builtin.template:
    src: compose.yaml.j2
    dest: "{{ stepca_base_dir }}/compose.yaml"
    owner: root
    group: root
    mode: "0644"
  notify: restart step-ca

- name: Deploy step-ca environment file
  ansible.builtin.template:
    src: env.j2
    dest: "{{ stepca_base_dir }}/.env"
    owner: root
    group: root
    mode: "0600"
  no_log: true
  notify: restart step-ca

- name: Create step-ca secrets directory
  ansible.builtin.file:
    path: "{{ stepca_data_dir }}/secrets"
    state: directory
    owner: "1000"
    group: "1000"
    mode: "0700"

- name: Write CA password file
  ansible.builtin.copy:
    content: "{{ stepca_ca_password }}"
    dest: "{{ stepca_data_dir }}/secrets/password"
    owner: "1000"
    group: "1000"
    mode: "0600"
  no_log: true

- name: Check if step-ca is already initialized
  ansible.builtin.stat:
    path: "{{ stepca_data_dir }}/config/ca.json"
  register: stepca_config

- name: Initialize step-ca (first run only)
  when: not stepca_config.stat.exists
  block:
    - name: Run step-ca initialization
      community.docker.docker_container:
        name: "{{ stepca_container_name }}-init"
        image: "{{ stepca_image }}:{{ stepca_image_tag }}"
        command: >-
          step ca init
          --name "{{ stepca_ca_name }}"
          --dns "{{ stepca_dns_names }}"
          --address ":{{ stepca_listen_port }}"
          --provisioner "admin"
          --password-file /home/step/secrets/password
          --ssh
          --remote-management
        volumes:
          - "{{ stepca_data_dir }}:/home/step"
        state: started
        detach: false
        cleanup: true
      register: stepca_init

    - name: Display CA fingerprint
      ansible.builtin.debug:
        msg: "{{ stepca_init.container.Output }}"
      when: stepca_init is changed

- name: Start step-ca
  community.docker.docker_compose_v2:
    project_src: "{{ stepca_base_dir }}"
    state: present

- name: Template OIDC provisioner patch script
  ansible.builtin.template:
    src: patch_oidc_provisioner.py.j2
    dest: "{{ stepca_base_dir }}/patch_oidc_provisioner.py"
    owner: root
    group: root
    mode: "0700"
  no_log: true

- name: Patch OIDC provisioner in ca.json
  ansible.builtin.command:
    cmd: python3 {{ stepca_base_dir }}/patch_oidc_provisioner.py
  register: oidc_patch_result
  changed_when: "'CHANGED' in oidc_patch_result.stdout"

- name: Restart step-ca if OIDC provisioner changed
  community.docker.docker_compose_v2:
    project_src: "{{ stepca_base_dir }}"
    state: restarted
  when: oidc_patch_result is changed

- name: Clean up patch script
  ansible.builtin.file:
    path: "{{ stepca_base_dir }}/patch_oidc_provisioner.py"
    state: absent