---

# ---
# TLS Certificate
# ---

# - method 'generate'

- name: Build Pure-FTPd TLS subject.
  ansible.builtin.set_fact:
    common_pureftpd_tls_subject: >-
      /C={{ pureftpd_tls_certificate_openssl.country | default('') }}
      /ST={{ pureftpd_tls_certificate_openssl.state | default('') }}
      /L={{ pureftpd_tls_certificate_openssl.locality | default('') }}
      /O={{ pureftpd_tls_certificate_openssl.organization | default('') }}
      /OU={{ pureftpd_tls_certificate_openssl.unit | default('') }}
      /CN={{ pureftpd_tls_certificate_openssl.fqdn }}
  when:
    - pureftpd_tls_certificate_method == 'generate'
    - pureftpd_tls_certificate_openssl | length > 0

- name: Generate Pure-FTPd TLS certificate.
  ansible.builtin.command:
    argv:
      - openssl
      - req
      - -x509
      - -nodes
      - -newkey
      - rsa:{{ pureftpd_tls_certificate_openssl.size | default(4096) }}
      - -sha256
      - -days
      - '{{ pureftpd_tls_certificate_openssl.days | default(365) }}'
      - -keyout
      - '{{ pureftpd_tls_certificate_pem }}'
      - -out
      - '{{ pureftpd_tls_certificate_pem }}'
      - -subj
      - '{{ common_pureftpd_tls_subject }}'
  args:
    creates: "{{ pureftpd_tls_certificate_pem }}"
  when:
    - pureftpd_tls_certificate_method == 'generate'
    - pureftpd_tls_certificate_openssl | length > 0
  notify: restart Pure-FTPd

- name: Ensure Pure-FTPd TLS certificate permissions.
  ansible.builtin.file:
    path: "{{ pureftpd_tls_certificate_pem }}"
    owner: root
    group: root
    mode: '0600'
    state: file
  when:
    - pureftpd_tls_certificate_method == 'generate'
    - pureftpd_tls_certificate_openssl | length > 0

# - final checks

- name: (pure-ftpd-install.yml) Verify TLS certificate exists.
  ansible.builtin.stat:
    path: "{{ pureftpd_tls_certificate_pem }}"
  register: common_pureftpd_tls_certificate

- name: (pure-ftpd-install.yml) Fail when no certificate is found.
  ansible.builtin.fail:
    msg: |
        The certificate file was not found at {{ pureftpd_tls_certificate_pem }}
  when: not common_pureftpd_tls_certificate.stat.exists | default(false)