---
- name: Exiger les secrets de l'AC (Vault)
  ansible.builtin.assert:
    that:
      - serveurs_step_ca_password | length > 0
      - serveurs_step_ca_provisioner_password | length > 0
    fail_msg: >-
      serveurs_step_ca_password et serveurs_step_ca_provisioner_password
      sont requis (a fournir via Ansible Vault).

- name: Assurer le repertoire des trousseaux apt
  ansible.builtin.file:
    path: /etc/apt/keyrings
    state: directory
    owner: root
    group: root
    mode: "0755"

- name: Telecharger la cle de signature Smallstep
  ansible.builtin.get_url:
    url: "{{ serveurs_step_ca_depot_cle_url }}"
    dest: "{{ serveurs_step_ca_depot_cle_fichier }}"
    owner: root
    group: root
    mode: "0644"

- name: Ajouter le depot apt Smallstep
  ansible.builtin.template:
    src: smallstep.sources.j2
    dest: /etc/apt/sources.list.d/smallstep.sources
    owner: root
    group: root
    mode: "0644"

- name: Installer step-ca et step-cli
  ansible.builtin.apt:
    name: "{{ serveurs_step_ca_paquets }}"
    state: present
    update_cache: true

- name: Creer l'utilisateur systeme step
  ansible.builtin.user:
    name: "{{ serveurs_step_ca_utilisateur }}"
    system: true
    home: "{{ serveurs_step_ca_steppath }}"
    create_home: false
    shell: /usr/sbin/nologin

- name: Creer le repertoire STEPPATH
  ansible.builtin.file:
    path: "{{ serveurs_step_ca_steppath }}"
    state: directory
    owner: "{{ serveurs_step_ca_utilisateur }}"
    group: "{{ serveurs_step_ca_utilisateur }}"
    mode: "0700"

- name: Deployer le mot de passe de l'AC
  ansible.builtin.copy:
    content: "{{ serveurs_step_ca_password }}"
    dest: "{{ serveurs_step_ca_steppath }}/password.txt"
    owner: "{{ serveurs_step_ca_utilisateur }}"
    group: "{{ serveurs_step_ca_utilisateur }}"
    mode: "0600"
  no_log: true
  notify: Redemarrer step-ca

- name: Deployer le mot de passe du provisioner
  ansible.builtin.copy:
    content: "{{ serveurs_step_ca_provisioner_password }}"
    dest: "{{ serveurs_step_ca_steppath }}/provisioner_password.txt"
    owner: "{{ serveurs_step_ca_utilisateur }}"
    group: "{{ serveurs_step_ca_utilisateur }}"
    mode: "0600"
  no_log: true

- name: Initialiser l'autorite de certification (une seule fois)
  ansible.builtin.command:
    cmd: >-
      step ca init
      --deployment-type standalone
      --name "{{ serveurs_step_ca_nom }}"
      --dns "{{ serveurs_step_ca_dns }}"
      --address "{{ serveurs_step_ca_adresse }}"
      --provisioner "{{ serveurs_step_ca_provisioner }}"
      --password-file {{ serveurs_step_ca_steppath }}/password.txt
      --provisioner-password-file {{ serveurs_step_ca_steppath }}/provisioner_password.txt
      {{ '--acme' if serveurs_step_ca_acme | bool else '' }}
    creates: "{{ serveurs_step_ca_steppath }}/config/ca.json"
  become: true
  become_user: "{{ serveurs_step_ca_utilisateur }}"
  environment:
    STEPPATH: "{{ serveurs_step_ca_steppath }}"

- name: Deployer l'unite systemd step-ca
  ansible.builtin.template:
    src: step-ca.service.j2
    dest: /etc/systemd/system/step-ca.service
    owner: root
    group: root
    mode: "0644"
  notify: Redemarrer step-ca

- name: Activer et demarrer step-ca
  ansible.builtin.systemd:
    name: "{{ serveurs_step_ca_service }}"
    enabled: true
    state: started
    daemon_reload: true