---
- name: Get latest lego version
  become: false
  delegate_to: localhost
  run_once: true
  when: lego_version is undefined
  block:
    - name: Get latest version from Github
      github_release:  # needs Python Module github3.py
        user: go-acme
        repo: lego
        action: latest_release
        token: "{{ vault_github_token }}"
      register: lego_github_version

    - name: "{{ lego_github_version }}"
      set_fact:
        lego_version: "{{ lego_github_version.tag }}"

- name: Set architecture alias
  set_fact:
    architecture_alias: "amd64"  # noqa: var-naming[no-role-prefix]
  when: ansible_architecture == "x86_64"

- name: Set architecture alias
  set_fact:
    architecture_alias: "arm64"  # noqa: var-naming[no-role-prefix]
  when: ansible_architecture == "aarch64"

- name: "Download lego from GitHub"
  get_url:
    url: "https://github.com/go-acme/lego/releases/download/\
          {{ lego_version }}/lego_{{ lego_version }}\
          _linux_{{ architecture_alias }}.tar.gz"
    dest: "/var/tmp/lego.tar.gz"
    mode: "0644"
  register: lego_download_archive
  until: lego_download_archive is succeeded
  retries: 3
  delay: 5

- name: Unpack lego
  unarchive:
    remote_src: true
    src: "/var/tmp/lego.tar.gz"
    dest: "{{ lego_install_dir }}"
    extra_opts:
      - --one-top-level
    include:
      - lego

- name: Create lego config directory
  file:
    path: "{{ lego_config_dir }}"
    mode: "0755"
    state: directory

- name: Copy ACME renew-hook script
  template:
    src: "renew-hook.sh.j2"
    dest: "{{ lego_config_dir }}/renew-hook.sh"
    mode: "0750"
  vars:
    lego_cert_dir: "{{ lego_config_dir }}/certificates"

- name: Register lego and create cert
  shell: >
      {{ lego_install_dir }}/lego --accept-tos
      --domains="{{ item.cn }}"
      {% if item.sans is defined and item.sans %}
      {% for san in item.sans %}--domains="{{ san }}" {% endfor %}
      {% endif %}
      {{ lego_cli_params | join(' ') }}
      run &&
      {{ lego_config_dir }}/renew-hook.sh '{{ item.cn }}'
  args:
    creates: "{{ lego_certificate_destination.path | default(lego_config_dir + '/certificates') }}/{{ item.cn }}.crt"
  environment: '{ "{{ lego_provider|upper }}_API_KEY": "{{ vault_ionos_token_dns }}" }'
  loop: "{{ lego_certificate_domains }}"
  loop_control:
    label: "{{ item.cn }}"

- name: Copy lego systemd service
  template:
    src: "lego.{{ item.1 }}.j2"
    dest: "/etc/systemd/system/lego_{{ item.0.cn }}.{{ item.1 }}"
    mode: "0644"
  loop: "{{ lego_certificate_domains | product(['service', 'timer']) | list }}"
  loop_control:
    label: "lego_{{ item.0.cn }}.{{ item.1 }}"

- name: Start lego_timer
  systemd:
    daemon_reload: true
    enabled: true
    name: "lego_{{ item.cn }}.timer"
    state: started
  loop: "{{ lego_certificate_domains }}"