---
- name: Install openssl and certbot
  apt:
    name:
      - openssl
      - ssl-cert
      - certbot
      - python3-certbot-nginx

- name: Add nginx configuration
  template:
    src: "{{ nginx_conf_file }}"
    dest: "/etc/nginx/sites-available/{{ nginx_conf_filename }}"
  notify: Restart nginx
  when: nginx_conf_file is defined

- name: Check certbot certificate
  stat:
    path: /etc/letsencrypt/renewal/{{ nginx_domain }}.conf
  register: certbot_renewal_conf

- when: use_certbot and not certbot_renewal_conf.stat.exists
  block:
    - name: Modify SSL certificate to use self-signed certificate
      lineinfile:
        path: "/etc/nginx/sites-available/{{ nginx_conf_filename }}"
        regexp: '^(\s+)ssl_certificate '
        line: '  ssl_certificate /etc/ssl/certs/ssl-cert-snakeoil.pem;'

    - name: Modify SSL key to use self-signed key
      lineinfile:
        path: "/etc/nginx/sites-available/{{ nginx_conf_filename }}"
        regexp: '^(\s+)ssl_certificate_key '
        line: '  ssl_certificate_key /etc/ssl/private/ssl-cert-snakeoil.key;'

- name: Enable nginx configuration
  file:
    src: "/etc/nginx/sites-available/{{ nginx_conf_filename }}"
    dest: "/etc/nginx/sites-enabled/{{ nginx_conf_filename }}"
    state: link
  notify: Restart nginx
  when: nginx_conf_file is defined

- name: Force all notified handlers to run at this point, not waiting for normal sync points
  meta: flush_handlers

- when: use_certbot == true and not certbot_renewal_conf.stat.exists
  block:
    - name: Generate certbot certificate
      command: "certbot certonly --nginx -n --agree-tos -m dev@lafourmi-immo.com -d {{ nginx_domain }}"

    - name: Add nginx configuration
      template:
        src: "{{ nginx_conf_file }}"
        dest: "/etc/nginx/sites-available/{{ nginx_conf_filename }}"
      notify: Restart nginx
      when: nginx_conf_file is defined