---

- name: generate simple ssl key and self-signed certificate
  ansible.builtin.command:
    cmd: |
      openssl req
      -x509
      -newkey rsa:4096
      -nodes
      -subj "/CN={{ item.domain }}"
      -keyout {{ relayd__ssl_keys_dir }}/{{ item.domain }}.key
      -out {{ relayd__ssl_certificates_dir }}/{{ item.domain }}.pem
    creates: "{{ relayd__ssl_keys_dir }}/{{ item.domain }}.key"
  loop: "{{ relayd__rules }}"

- name: apply restrictive permissions on ssl keys
  ansible.builtin.file:
    path: "{{ relayd__ssl_keys_dir }}/{{ item.domain }}.key"
    owner: 0
    group: 0
    mode: "0600"
  loop: "{{ relayd__rules }}"

- name: retrieve certificate files
  ansible.builtin.stat:
    path: "{{ relayd__ssl_certificates_dir }}/{{ item.domain }}.crt"
  loop: "{{ relayd__rules }}"
  register: relayd__result_stat_certificates

- name: link pem files to certificate files if required
  ansible.builtin.file:
    src: "{{ relayd__ssl_certificates_dir }}/{{ item.item.domain }}.pem"
    dest: "{{ item.invocation.module_args.path }}"
    owner: 0
    group: 0
    state: link
  when: not item.stat.exists
  loop: "{{ relayd__result_stat_certificates.results }}"

- name: generate relayd configuration
  ansible.builtin.template:
    src: relayd.conf.j2
    dest: "{{ relayd__configuration_file }}"
    owner: 0
    group: 0
    mode: "0640"
  register: relayd__result_generate_configuration

- name: lint relayd configuration
  ansible.builtin.command: "relayd -nf {{ relayd__configuration_file }}"
  register: relayd__result_lint_configuration
  changed_when:
    - relayd__result_generate_configuration.changed
    - relayd__result_lint_configuration.rc != 0

- name: restart relayd  # noqa: no-handler
  ansible.builtin.service:
    name: relayd
    state: restarted
  when: relayd__result_generate_configuration.changed
    or relayd__result_lint_configuration.changed

- name: enable relayd
  ansible.builtin.service:
    name: relayd
    enabled: true