---
#--------------------------------------------------------------#
# Issue MongoDB certs                         [mongo_cert_issue]
#--------------------------------------------------------------#
- name: generate mongo server certs
  tags: mongo_cert_issue
  become: false
  connection: local
  vars:
    ansible_python_interpreter: "{{ ansible_playbook_python }}"
  block:

    - name: generate mongo private key
      connection: local
      openssl_privatekey:
        path: files/pki/mongo/{{ mongo_instance }}.key
        mode: 0600

    - name: generate mongo signing request
      connection: local
      openssl_csr:
        path: "files/pki/csr/{{ mongo_instance }}.csr"
        privatekey_path: "files/pki/mongo/{{ mongo_instance }}.key"
        common_name: "{{ mongo_instance }}"
        organization_name: pigsty
        organizational_unit_name: mongo
        subject_alt_name: "{{ ['IP:127.0.0.1', 'DNS:localhost', 'IP:' ~ inventory_hostname, 'DNS:' ~ mongo_instance] + (['DNS:' ~ nodename] if nodename is defined and nodename != '' else []) }}"

    - name: issue mongo server certificate
      connection: local
      openssl_certificate:
        path: "files/pki/mongo/{{ mongo_instance }}.crt"
        csr_path: "files/pki/csr/{{ mongo_instance }}.csr"
        provider: ownca
        ownca_path: files/pki/ca/ca.crt
        ownca_privatekey_path: files/pki/ca/ca.key
        ownca_not_after: "+{{ cert_validity }}"
        mode: 0644


#--------------------------------------------------------------#
# Copy MongoDB certs                           [mongo_cert_copy]
#--------------------------------------------------------------#
- name: copy mongo certs
  tags: mongo_cert_copy
  become: true
  block:
    - name: copy ca file
      copy: src="files/pki/ca/ca.crt" dest="/var/lib/mongod/ca.crt" owner=mongod mode=0644
    - name: copy mongo ssl cert
      copy: src="files/pki/mongo/{{ mongo_instance }}.crt" dest="/var/lib/mongod/server.crt" owner=mongod mode=0644
    - name: copy mongo ssl key
      copy: src="files/pki/mongo/{{ mongo_instance }}.key" dest="/var/lib/mongod/server.key" owner=mongod mode=0600

...