---
- name: Install pki directory
  ansible.builtin.file:
    path: /etc/pki/
    state: directory
    mode: '0700'
    owner: root
    group: root

- name: Install CA directory
  ansible.builtin.file:
    path: /etc/pki/konchin.com/
    state: directory
    mode: '0700'
    owner: root
    group: root

- name: Check for existing root ca certificate
  ansible.builtin.stat:
    path: /etc/pki/konchin.com/rootca.pem
  register: create_rootca_existing

# The x509_certificate/openssl_privatekey modules recompute their relative
# validity/date options on every run, which never exactly matches the fixed
# timestamps baked into an already-issued certificate. Left unguarded, that
# makes them "regenerate" the CA (and invalidate every certificate it
# signed) on every playbook run. The CA is not meant to auto-rotate, so we
# only ever create it once.
- name: Create root ca
  when: not create_rootca_existing.stat.exists
  block:
    - name: Create private key for root ca
      community.crypto.openssl_privatekey:
        path: /etc/pki/konchin.com/rootca.key
        cipher: auto
        passphrase: "{{ secret_ca_passphrase }}"

    - name: Create CSR for root ca
      community.crypto.openssl_csr_pipe:
        privatekey_path: /etc/pki/konchin.com/rootca.key
        privatekey_passphrase: "{{ secret_ca_passphrase }}"
        common_name: Konchin.com CA
        use_common_name_for_san: false
        basic_constraints:
          - 'CA:TRUE'
        basic_constraints_critical: true
        key_usage:
          - keyCertSign
        key_usage_critical: true
      register: create_rootca_ca_csr

    - name: Create cert for root ca
      community.crypto.x509_certificate:
        path: /etc/pki/konchin.com/rootca.pem
        csr_content: "{{ create_rootca_ca_csr.csr }}"
        privatekey_path: /etc/pki/konchin.com/rootca.key
        privatekey_passphrase: "{{ secret_ca_passphrase }}"
        provider: selfsigned