- name: Skip wenn Zertifikat deaktiviert
  meta: end_host
  when: not (cert.enabled | default(false))

- name: Prüfe Profil
  fail:
    msg: "Kein Zertifikatsprofil definiert auf {{ inventory_hostname }}"
  when: cert.profile is not defined

- name: Lade Profildefinition
  set_fact:
    cert_cfg: "{{ cert_profiles[cert.profile] }}"

- name: Zielpfad setzen
  set_fact:
    cert_path: "{{ cert_base_path }}/{{ inventory_hostname }}"

- name: Verzeichnisse erstellen
  file:
    path: "{{ cert_path }}/{{ item }}"
    state: directory
    mode: '0755'
  loop:
    - KEY
    - CSR
    - CERT

- name: Installiere cryptography Abhängigkeit
  apt:
    name:
      - python3-cryptography
      - python3-pip
    state: present
    update_cache: true
  become: true
  ignore_errors: true

- name: Private Key erzeugen
  community.crypto.openssl_privatekey:
    path: "{{ cert_path }}/KEY/{{ inventory_hostname }}.key"
    size: "{{ cert_cfg.key_size }}"
    type: RSA

- name: FQDN bestimmen
  set_fact:
    cert_fqdn: >-
      {{
        ansible_facts['fqdn']
        | default(ansible_facts['hostname'])
        | default(inventory_hostname ~ '.local')
      }}

- name: SAN bauen (DNS + IP)
  set_fact:
    san_list: >-
      {{
        ['DNS:' ~ cert_fqdn]
        + ([ 'IP:' ~ ansible_host ] if ansible_host is defined else [])
      }}

- name: CSR erzeugen (dynamisch)
  community.crypto.openssl_csr:
    path: "{{ cert_path }}/CSR/{{ inventory_hostname }}.csr"
    privatekey_path: "{{ cert_path }}/KEY/{{ inventory_hostname }}.key"
    common_name: "{{ cert_fqdn }}"
    subject_alt_name: "{{ san_list }}"