---
- name: Deploy certificates
  when: __rsyslog_cert_subject | d([])
  block:
    # This block collect certificates from local location and
    # copies them to the target host
    - name: Manage certificates if TLS is enabled
      when: __rsyslog_cert_subject.tls is defined |
            ternary(__rsyslog_cert_subject.tls,
                __rsyslog_cert_subject.use_cert | d(true))
      block:
        - name: "Copy ca_cert on the control host to the specified path
            on the target host"
          copy:
            src: '{{ __rsyslog_cert_subject.ca_cert_src }}'
            dest: '{{ __rsyslog_cert_subject.ca_cert |
              d(__rsyslog_default_pki_path + __rsyslog_default_pki_cert_dir) }}'
            mode: '0444'
          when: __rsyslog_cert_subject.ca_cert_src | d()

        - name: "Copy cert on the control host to the specified path
            on the target host"
          copy:
            src: '{{ __rsyslog_cert_subject.cert_src }}'
            dest: '{{ __rsyslog_cert_subject.cert |
              d(__rsyslog_default_pki_path + __rsyslog_default_pki_cert_dir) }}'
            mode: '0444'
          when: __rsyslog_cert_subject.cert_src | d()

        - name: "Copy key on the control host to the specified path
            on the target host"
          copy:
            src: '{{ __rsyslog_cert_subject.private_key_src }}'
            dest: '{{ __rsyslog_cert_subject.private_key |
              d(__rsyslog_default_pki_path + __rsyslog_default_pki_key_dir) }}'
            mode: '0400'
          when: __rsyslog_cert_subject.private_key_src | d()

        - name: Check certs - tls is true, but triplets are not given
          fail:
            msg: "Error: you specified tls: true; you must specify all
              3 of ca_cert, cert, private_key, or all 3 of ca_cert_src,
              cert_src, private_key_src, or set tls: false in the
              configuration named {{ __rsyslog_cert_subject.name }}"
          when: not ((__rsyslog_cert_subject.ca_cert | d() and
                      __rsyslog_cert_subject.cert | d() and
                      __rsyslog_cert_subject.private_key | d()) or
                     (__rsyslog_cert_subject.ca_cert_src | d() and
                      __rsyslog_cert_subject.cert_src | d() and
                      __rsyslog_cert_subject.private_key_src | d()))

    - name: Check certs - key/certs data are provided, but tls is false
      debug:
        msg: "WARNING: you specified tls: false and also specified one or
          more cert/key files in the configuration named
          {{ __rsyslog_cert_subject.name }}"
      when:
        - not (__rsyslog_cert_subject.tls is defined |
               ternary(__rsyslog_cert_subject.tls,
               __rsyslog_cert_subject.use_cert | d(true)))
        - (__rsyslog_cert_subject.ca_cert | d() or
           __rsyslog_cert_subject.cert | d() or
           __rsyslog_cert_subject.private_key | d()) or
          (__rsyslog_cert_subject.ca_cert_src | d() or
           __rsyslog_cert_subject.cert_src | d() or
           __rsyslog_cert_subject.private_key_src | d())
