---
# vim: set expandtab tabstop=2 shiftwidth=2:

- name: Pull host pub
  register: host_pub
  slurp:
    src:  '{{ssh_cert_host_pub_path}}'
    #dest: '{{ssh_cert_base_dir}}/host-{{inventory_hostname}}.pub'
    #flat: true
- set_fact:
    host_pub_type: '{{(host_pub.content | b64decode).split(" ")[0]}}'
    host_pub_hash: '{{(host_pub.content | b64decode).split(" ")[1]}}'
    principals: "{{lookup( 'flattened',
        [inventory_hostname, inventory_hostname+'.'+domain, inventory_hostname+'.local'] + 
        lookup ('dig', inventory_hostname, 'qtype=A',    wantlist=True)|difference('NXDOMAIN') +
        lookup ('dig', inventory_hostname, 'qtype=AAAA', wantlist=True)|difference('NXDOMAIN') +
        (ssh_cert_host_addition_ids | default ([]))
      )}}"
- name: Register host pub for sshca
  remote_user: root
  delegate_to: '{{ssh_ca_host}}'
  authorized_key:
    user:        '{{ssh_ca_user}}'
    state:       present
    key:         '{{host_pub_type}} {{host_pub_hash}} {{inventory_hostname}}'
    key_options: 'restrict,command="/var/lib/sshca/ssh-ca host {{inventory_hostname|quote}} {{principals|quote}}"'

- name: Push ca pub
  copy: 
    src:  '{{ssh_cert_host_capub_path}}'
    dest: '{{ssh_cert_host_capub_path}}'
    mode: 0644
    owner: root
    group: root
- name: sshd_config - HostCertificate
  lineinfile:
    path:         /etc/ssh/sshd_config
    insertbefore: '^# HostKeys for protocol'
    regexp:       '^\s*HostCertificate\s+'
    line:         'HostCertificate {{ssh_cert_host_cert_path}}'
- name: known_hosts ca-cert
  known_hosts:
    hash_host: false
    path: /etc/ssh/ssh_known_hosts
    name: denkn.at
    key: "@cert-authority * {{lookup('file', ssh_cert_host_capub_path)}}"

- name: install ssh-cert-renew
  copy:
    dest: '{{item.value}}'
    src:  '{{item.key}}'
    mode: 0644
    owner: root
    group: root
  with_dict:
    ssh-cert-renew@.timer:   /etc/systemd/system/ssh-cert-renew@.timer
    ssh-cert-renew@.service: /etc/systemd/system/ssh-cert-renew@.service
- name: install ssh-cert-renew
  copy:
    dest: '{{item.value}}'
    src:  '{{item.key}}'
    mode: 0755
    owner: root
    group: root
  with_dict:
    ssh-cert-renew:          /etc/systemd/ssh-cert-renew

- name: config ssh-cert-renew
  lineinfile:
    create: true
    path:   '/etc/default/ssh-cert-renew'
    regexp: '^\s*{{item.key}}='
    line:   '{{item.key}}={{item.value}}'
  with_dict:
    ssh_cert_mail_to:   '{{ssh_cert_mail_to  |mandatory}}'
    ssh_cert_mail_from: '{{ssh_cert_mail_from|mandatory}}'
    ssh_cert_sign_host: '{{ssh_cert_sign_host|mandatory}}'

- name: renew ssh-cert
  systemd:
    daemon_reload: true
    name:  "ssh-cert-renew@ssh_host_ed25519_key.service"
    state: started
- name: enable services
  systemd:
    name:    '{{item}}'
    enabled: true
    state:   started
  with_items:
  - "ssh-cert-renew@ssh_host_ed25519_key.timer"
  - ssh.service

- name: reload ssh
  service:
    name:  ssh
    state: reloaded

- name: remove from local known_hosts
  known_hosts:
    state: absent
    host: '{{item}}'
  with_items: '{{principals.split(",")}}'