- hosts: master
  gather_facts: false
  tasks:
    - name: Making constants.py file compatable for including as vars.
      shell: sed -e "s/ =/:/g;s/'//g" /tmp/test_dir/constants.py > /tmp/constants.yml

    - name: Fetch the file
      fetch: src=/tmp/constants.yml dest=/tmp/test_dir/ flat=yes validate_checksum=no

    - name: Including variables from Environment
      include_vars:
        file: /tmp/test_dir/constants.yml
        name: variable

    - name: Get instance name
      set_fact: topology="{{ "-".join(variable.CA_INSTANCE_NAME.split("-")[:-1]) }}"

    - name: TEMPNSSDB
      shell: rm -rf /tmp/nssdb;mkdir /tmp/nssdb;certutil -N -d /tmp/nssdb --empty-password;pk12util -d /tmp/nssdb  -i /opt/{{ topology }}-CA/ca_admin_cert.p12 -W SECret.123;echo "y"|pki -d /tmp/nssdb -p {{ variable.CA_HTTPS_PORT }} client-cert-import --ca-server RootCA

    - name: Get runtime password for LDAP
      shell : cat /etc/dirsrv/slapd-{{ topology }}-testingmaster/pwdfile.txt
      register: ldapPasswd

    - name: Request for LDAP server certificate with our CA
      expect:
        command: "pki -d /etc/dirsrv/slapd-{{ topology }}-testingmaster/ -p {{ variable.CA_HTTPS_PORT }} -h {{ variable.MASTER_HOSTNAME }} -c {{ ldapPasswd.stdout }} client-cert-request CN={{ variable.MASTER_HOSTNAME }} --profile caServerCert --type pkcs10"
        responses:
          Trust this certificate (y/N)?: "y"
      register: serial

    - name: Get request id for LDAP csr
      set_fact : serialvar="{{ serial.stdout_lines[1].split(':')[-1] }}"

    - name: Sending this request for CA signing
      pki:
        cli: "ca-cert-request-review"
        hostname : "{{ variable.MASTER_HOSTNAME }}"
        nssdb : "/tmp/nssdb"
        protocol: "https"
        port: "{{ variable.CA_HTTPS_PORT }}"
        extra_args: "{{ serialvar }} --action approve"
      register: cert

    - name: Get request id for LDAP certificate
      set_fact : serialvar="{{ cert.stdout_lines[-1].split(':')[1] }}"

    - name: Get Ldap certificate to a file
      pki:
        cli: "ca-cert-show"
        hostname : "{{ variable.MASTER_HOSTNAME }}"
        nssdb : "/tmp/nssdb"
        protocol: "https"
        port: "{{ variable.CA_HTTPS_PORT }}"
        extra_args: "{{ serialvar }} --output /etc/dirsrv/slapd-{{ topology }}-testingmaster/ds.crt"

    - name: Get CA signing certificate file
      shell : echo -e "n"|pki -d /tmp/nssdb -p {{ variable.CA_HTTPS_PORT }} -h {{ variable.MASTER_HOSTNAME }} -c {{ variable.CLIENT_DIR_PASSWORD }} -n "{{ variable.CA_ADMIN_NICK }}" ca-cert-find --name 'CA Signing Certificate' | grep -i serial | awk -F':' ' { print $2 } '
      register: cert

    - name: Get Ldap certificate to a file
      pki:
        cli: "ca-cert-show"
        hostname : "{{ variable.MASTER_HOSTNAME }}"
        protocol: "https"
        nssdb : "/tmp/nssdb"
        port: "{{ variable.CA_HTTPS_PORT }}"
        extra_args: "{{ cert.stdout }} --output /etc/dirsrv/slapd-{{ topology }}-testingmaster/ca.crt"

    - name: Removing Existing certifcates
      shell: certutil -D -d /etc/dirsrv/slapd-{{ topology }}-testingmaster/ -n {{ item }}
      ignore_errors: True
      with_items:
          - "Server-Cert"

    - name: Get Ldap certificate to a file
      pki:
        cli: "client-cert-import"
        hostname : "{{ variable.MASTER_HOSTNAME }}"
        nssdb : "/etc/dirsrv/slapd-{{ topology }}-testingmaster/"
        protocol: "https"
        authType: "basicAuth"
        dbpassword: "{{ ldapPasswd.stdout }}"
        port: "{{ variable.CA_HTTPS_PORT }}"
        extra_args: "'CA Certificate' --ca-cert /etc/dirsrv/slapd-{{ topology }}-testingmaster/ca.crt"

    - name: Get Ldap certificate to a file
      pki:
        cli: "client-cert-import"
        hostname : "{{ variable.MASTER_HOSTNAME }}"
        nssdb : "/etc/dirsrv/slapd-{{ topology }}-testingmaster/"
        protocol: "https"
        authType : "basicAuth"
        dbpassword: "{{ ldapPasswd.stdout }}"
        port: "{{ variable.CA_HTTPS_PORT }}"
        extra_args: "'Server-Cert' --cert /etc/dirsrv/slapd-{{ topology }}-testingmaster/ds.crt"

    - name: Starting LDAP
      shell: dsctl slapd-{{ topology }}-testingmaster start
