- name: Sleep for a while to give time of any other instances to come up.
  shell: sleep 7s

- name: Install TKS master
  shell: pkispawn -s TKS -f /tmp/test_dir/tks.cfg

- name : Stopping TKS Subsystem
  shell: echo "Stopping Subsystem for enabling Audit logging"
  notify:
    - STOPTKS
    - INC_CONSTANTS

- meta: flush_handlers

- name: Set debug log level to 5
  shell: pki-server -i {{ topology }}-TKS tks-config-set debug.level 5
  when: debug == "true" or tks_debug == "true"

- name: Enable SignedAudit
  replace: dest=/etc/pki/{{ topology }}-TKS/tks/CS.cfg regexp="log.instance.SignedAudit.logSigning=false" replace="log.instance.SignedAudit.logSigning=true"

- name: Enable OCSP for TKS
  replace: dest=/etc/pki/{{ topology }}-TKS/server.xml regexp='enableOCSP="false"' replace='enableOCSP="true"'

- name: Pointing TKS to correct OCSP port
  replace: dest=/etc/pki/{{ topology }}-TKS/server.xml regexp='([0-9]+)/ca/ocsp' replace={{ variable.CA_HTTP_PORT }}/ca/ocsp

- name: Enable OCSP Policy to Native for tls as true
  block:
  - name: Checking for right CA certificate
    shell: sed -i "s/ocspSigningCert cert-pki-ca/Directory Server CA certificate/g" /etc/pki/{{ topology }}-TKS/server.xml
  when: tls_ldap == "true"

- name: Enable OCSP Policy to Native for tls as false
  block:
  - name: Picking the password in run-time from password.conf of TKS
    shell: grep -i "internal=" /etc/pki/{{ topology }}-TKS/password.conf | awk -F"=" ' { print $2 } ' > /tmp/test_dir/certutil_password

  - name: Importing OCSP certificate in TKS nssdb
    shell: certutil -A -d /etc/pki/{{ topology }}-TKS/alias -n "ocspSigningCert cert-pki-ca" -t "C,," -i  /tmp/test_dir/ocsp_signing.crt -f /tmp/test_dir/certutil_password

  - name: Removing file generated with password
    file:
      path: "{{ item }}"
      state: absent
    with_items:
      -  /tmp/test_dir/certutil_password
  when: tls_ldap == "false"

- meta: flush_handlers

- name: Starting TKS Subsystem
  service:
    name: pki-tomcatd@{{ topology }}-TKS.service
    state: started

- name: Sleep for a while to start TKS
  shell: sleep 3s

- name: TKS Clone Preparation
  block:
    - name: Export TKS subsystem certificates
      shell: pki-server tks-clone-prepare -i {{topology}}-TKS --pkcs12-file /tmp/tks_certs.p12 --pkcs12-password {{variable.CLIENT_PKCS12_PASSWORD}}

    - name: Get the TKS subsystem certificates to the local
      fetch: src=/tmp/tks_certs.p12 dest=/tmp/test_dir/clonecerts/ flat=yes
  when: clone == "true" or clone == "True"
