- name: install openvpn-openssl package
  opkg:
    name: openvpn-openssl
    state: present

- name: create openvpn KEY
  shell: 'openssl genrsa -out /etc/openvpn/openvpn.key 2048'
  args:
    creates: /etc/openvpn/openvpn.key
  notify: reload openvpn


- name: create openvpn dh2048
  shell: 'openssl dhparam -out /etc/openvpn/dh2048.pem 2048'
  args:
    creates: /etc/openvpn/dh2048.pem
  notify: reload openvpn


- name: create CSR
  shell: 'openssl req -new -sha256 -subj "/C=IT/ST=ITALY/L=TUSCANY/O=IT/CN={{ ansible_hostname }}.lilik.it" -key /etc/openvpn/openvpn.key -out /etc/openvpn/openvpn.csr'
  args:
    creates: /etc/openvpn/openvpn.csr
  notify: reload openvpn

- name: check if openvpn cert key exist
  stat:
    path: /etc/openvpn/openvpn.cert
  register: openvpn_cert_key

- block:
    - name: get pub key
      shell: "cat /etc/openvpn/openvpn.csr"
      register: pub_key
    - debug: var=pub_key verbosity=2
    - name: generate host request
      set_fact:
        cert_request:
          type: 'sign_request'
          request:
            keyType: 'ssl_host'
            hostName: '{{ inventory_hostname }}'
            keyData: '{{ pub_key.stdout }}'
    - debug: var=cert_request verbosity=2
    - name: start sign request
      raw: "{{ cert_request | to_json }}"
      delegate_to: "{{item}}"
      delegate_facts: True
      with_items: "{{groups['cas']}}"
      register: request_result
    - debug: var=request_result verbosity=2

    - set_fact:
          request_output: "{{ request_result.results[0].stdout|string|from_json }}"
    - debug: var=request_output

    - name: generate get request
      set_fact:
        get_request:
          type: 'get_certificate'
          requestID: '{{ request_output.requestID }}'
    - debug: var=get_request verbosity=2

    - debug: msg="Please manualy confirm sign request with id {{ request_output.requestID }}"

    - name: wait for cert
      raw: "{{ get_request | to_json }}"
      delegate_to: "{{item}}"
      delegate_facts: True
      with_items: "{{groups['cas']}}"
      register: cert_result

    - debug: var=cert_result verbosity=2

    - set_fact:
          cert_key: "{{ cert_result.results[0].stdout|string|from_json }}"

    - debug: var=request_output verbosity=2

    - name: set pub key
      shell: "echo '{{ cert_key.result }}' > /etc/openvpn/openvpn.cert"
      register: set_pub_key
  when: not openvpn_cert_key.stat.exists

- name: copy vpn ca public key
  copy:
    src: test_vpn_ca.crt
    dest: /etc/openvpn/ca.crt

- name: write openvpn configuration
  template:
    dest=/etc/config/openvpn
    src=openvpn.j2
    owner=root
    group=root
    mode=0400
  register: new_vpn_config
  notify: reload openvpn

- name: commit openvpn configuration to uci
  shell: 'uci commit openvpn'
  notify: reload openvpn
  when: new_vpn_config.changed