- name: "Setup: Koji PKI Directory Structure"
  tags: setup
  block:
    - name: "Create Koji PKI directory"
      ansible.builtin.file:
        path: "{{ koji_pki_dir }}"
        state: directory
        mode: "{{ koji_pki_dir_mode }}"

    - name: "Create certificate database files"
      ansible.builtin.copy:
        content: "{{ item.content }}"
        dest: "{{ koji_pki_dir }}/{{ item.name }}"
        mode: "{{ koji_pki_file_mode }}"
      loop:
        - { name: "index.txt", content: "" }
        - { name: "serial", content: "01\n" }

- name: "Generate: Koji Certificate Authority (CA)"
  tags: ca
  block:
    - name: "Generate CA private key"
      community.crypto.openssl_privatekey:
        path: "{{ koji_pki_dir }}/{{ koji_ca_name }}_cert.key"
        size: "{{ koji_cert_key_size }}"
        mode: "{{ koji_pki_private_key_mode }}"

    - name: "Generate CA CSR"
      community.crypto.openssl_csr:
        path: "{{ koji_pki_dir }}/{{ koji_ca_name }}_cert.csr"
        privatekey_path: "{{ koji_pki_dir }}/{{ koji_ca_name }}_cert.key"
        common_name: "Koji Certificate Authority"
        organization_name: "{{ koji_cert_organization }}"
        state_or_province_name: "{{ koji_cert_state }}"
        locality_name: "{{ koji_cert_locality }}"
        country_name: "{{ koji_cert_country }}"
        basic_constraints:
          - "CA:TRUE"
        key_usage:
          - keyCertSign
          - cRLSign

    - name: "Generate self-signed CA certificate"
      community.crypto.x509_certificate:
        path: "{{ koji_pki_dir }}/{{ koji_ca_name }}_cert.crt"
        csr_path: "{{ koji_pki_dir }}/{{ koji_ca_name }}_cert.csr"
        privatekey_path: "{{ koji_pki_dir }}/{{ koji_ca_name }}_cert.key"
        provider: selfsigned
        selfsigned_not_after: "+{{ koji_cert_expiration_days }}d"

- name: "Generate: Component and User Certificates"
  ansible.builtin.include_tasks: generate_single_cert.yaml
  loop: "{{ koji_certs_to_generate }}"
  loop_control:
    loop_var: cert
  tags: components

- name: Create GPG key batch file
  ansible.builtin.copy:
    content: |
      %echo Generating a basic OpenPGP key
      Key-Type: RSA
      Key-Length: 4096
      Subkey-Type: RSA
      Subkey-Length: 4096
      Name-Real: Koji Signing Key
      Name-Email: koji@{{ koji_hub_fqdn }}
      Expire-Date: 0
      Passphrase: {{ gpg_key_passphrase }}
      %commit
      %echo done
    dest: "{{ koji_pki_dir }}/gpg_batch"
    mode: "0600"
  delegate_to: localhost
  run_once: true

- name: Generate GPG key
  ansible.builtin.shell:
    cmd: "gpg --batch --gen-key {{ koji_pki_dir }}/gpg_batch"
    creates: "{{ koji_pki_dir }}/gpg_key.pub"
  delegate_to: localhost
  run_once: true

- name: Export GPG public key
  ansible.builtin.shell:
    cmd: "gpg --armor --export 'Koji Signing Key' > {{ koji_pki_dir }}/gpg_key.pub"
    creates: "{{ koji_pki_dir }}/gpg_key.pub"
  delegate_to: localhost
  run_once: true

- name: "Remove existing host keys"
  ansible.builtin.shell:
    cmd: "ssh-keygen -R {{ item }}"
  loop: "{{ groups['all'] }}"
  ignore_errors: true

- name: "Add new host keys"
  ansible.builtin.known_hosts:
    name: "{{ item }}"
    key: "{{ lookup('pipe', 'ssh-keyscan -t rsa {{ item }}') }}"
    state: present
  loop: "{{ groups['all'] }}"