---
- name: prepare list of client certificates
  ansible.builtin.set_fact:
    cert_list: "{{ cert_list | default([]) + [ {'instance': item.0.name, 'pki_dir': item.0.pki_dir, 'client': item.1} ] }}"
  loop: "{{ openvpn_instances | subelements('clients') }}"

- name: ensure local PKI directories exist
  ansible.builtin.file:
    path: "{{ item.pki_dir }}"
    state: directory
    mode: '0700'
  loop: "{{ openvpn_instances }}"

- name: init pki if missing
  ansible.builtin.command:
    cmd: /opt/easy-rsa/easyrsa --batch init-pki
    creates: "{{ item.pki_dir }}/private"
  environment:
    EASYRSA_PKI: "{{ item.pki_dir }}"
  loop: "{{ openvpn_instances }}"

- name: build ca if missing
  ansible.builtin.command:
    cmd: /opt/easy-rsa/easyrsa --batch build-ca nopass
    creates: "{{ item.pki_dir }}/ca.crt"
  environment:
    EASYRSA_PKI: "{{ item.pki_dir }}"
    EASYRSA_REQ_CN: "CA-{{ item.name }}"
  loop: "{{ openvpn_instances }}"

- name: build server cert if missing
  ansible.builtin.command:
    cmd: /opt/easy-rsa/easyrsa --batch build-server-full server nopass
    creates: "{{ item.pki_dir }}/issued/server.crt"
  environment:
    EASYRSA_PKI: "{{ item.pki_dir }}"
  loop: "{{ openvpn_instances }}"

- name: generate dh params if missing
  ansible.builtin.command:
    cmd: /opt/easy-rsa/easyrsa gen-dh
    creates: "{{ item.pki_dir }}/dh.pem"
  environment:
    EASYRSA_PKI: "{{ item.pki_dir }}"
  loop: "{{ openvpn_instances }}"

- name: check client certificates validity
  ansible.builtin.command:
    cmd: "openssl x509 -checkend 2592000 -in {{ item.pki_dir }}/issued/{{ item.client.name }}.crt"
  register: cert_check
  failed_when: false
  changed_when: false
  loop: "{{ cert_list }}"

- name: remove old cert file before reissue
  ansible.builtin.file:
    path: "{{ item.item.pki_dir }}/issued/{{ item.item.client.name }}.crt"
    state: absent
  loop: "{{ cert_check.results }}"
  when: item.rc != 0

- name: remove old req file before reissue
  ansible.builtin.file:
    path: "{{ item.item.pki_dir }}/reqs/{{ item.item.client.name }}.req"
    state: absent
  loop: "{{ cert_check.results }}"
  when: item.rc != 0

- name: remove old key file before reissue
  ansible.builtin.file:
    path: "{{ item.item.pki_dir }}/private/{{ item.item.client.name }}.key"
    state: absent
  loop: "{{ cert_check.results }}"
  when: item.rc != 0

- name: issue or renew client certificates
  ansible.builtin.command:
    cmd: /opt/easy-rsa/easyrsa --batch build-client-full "{{ item.item.client.name }}" nopass
  environment:
    EASYRSA_PKI: "{{ item.item.pki_dir }}"
  when: item.rc != 0
  loop: "{{ cert_check.results }}"