---
- name: Exiger les secrets PKI (Vault)
  ansible.builtin.assert:
    that:
      - client_pki_ca_fingerprint | length > 0
      - client_pki_provisioner_password | length > 0
    fail_msg: >-
      client_pki_ca_fingerprint et client_pki_provisioner_password
      sont requis (a fournir via Ansible Vault).

- name: Assurer le repertoire des trousseaux apt
  ansible.builtin.file:
    path: /etc/apt/keyrings
    state: directory
    owner: root
    group: root
    mode: "0755"

- name: Telecharger la cle de signature Smallstep
  ansible.builtin.get_url:
    url: "{{ client_pki_depot_cle_url }}"
    dest: "{{ client_pki_depot_cle_fichier }}"
    owner: root
    group: root
    mode: "0644"

- name: Ajouter le depot apt Smallstep
  ansible.builtin.template:
    src: smallstep.sources.j2
    dest: /etc/apt/sources.list.d/smallstep.sources
    owner: root
    group: root
    mode: "0644"

- name: Installer step-cli
  ansible.builtin.apt:
    name: "{{ client_pki_paquets }}"
    state: present
    update_cache: true

- name: Creer le repertoire STEPPATH des certificats
  ansible.builtin.file:
    path: "{{ client_pki_steppath }}/certs"
    state: directory
    owner: root
    group: root
    mode: "0755"

- name: Deployer le mot de passe du provisioner
  ansible.builtin.copy:
    content: "{{ client_pki_provisioner_password }}"
    dest: "{{ client_pki_steppath }}/provisioner.pass"
    owner: root
    group: root
    mode: "0600"
  no_log: true

- name: Etablir la confiance dans l'AC interne (bootstrap + installation racine)
  ansible.builtin.command:
    cmd: >-
      step ca bootstrap
      --ca-url {{ client_pki_ca_url }}
      --fingerprint {{ client_pki_ca_fingerprint }}
      --install --force
    creates: "{{ client_pki_steppath }}/certs/root_ca.crt"
  environment:
    STEPPATH: "{{ client_pki_steppath }}"

- name: Obtenir le certificat d'hote
  ansible.builtin.command:
    cmd: >-
      step ca certificate {{ client_pki_nom_cert }}
      {{ client_pki_cert }} {{ client_pki_cle }}
      --provisioner {{ client_pki_provisioner }}
      --provisioner-password-file {{ client_pki_steppath }}/provisioner.pass
      --force
    creates: "{{ client_pki_cert }}"
  environment:
    STEPPATH: "{{ client_pki_steppath }}"

- name: Deployer l'unite systemd de renouvellement
  ansible.builtin.template:
    src: cert-renewer@.service.j2
    dest: /etc/systemd/system/cert-renewer@.service
    owner: root
    group: root
    mode: "0644"
  notify: Recharger systemd

- name: Deployer le minuteur de renouvellement
  ansible.builtin.template:
    src: cert-renewer@.timer.j2
    dest: /etc/systemd/system/cert-renewer@.timer
    owner: root
    group: root
    mode: "0644"
  notify: Recharger systemd

- name: Activer le renouvellement automatique du certificat d'hote
  ansible.builtin.systemd:
    name: "cert-renewer@{{ client_pki_nom_cert }}.timer"
    enabled: true
    state: started
    daemon_reload: true