---
#--------------------------------------------------------------#
# Config etcd                                        [etcd_conf]
#--------------------------------------------------------------#
- name: setup etcd server
  tags: etcd_conf
  block:
    - name: print etcd configuration info
      debug:
        msg: "ETCDCTL_ENDPOINTS={% for ip in groups[etcd_cluster]|sort %}{% if not loop.first %},{% endif %}https://{{ ip }}:{{ etcd_port }}{% endfor %}"

    - name: generate etcd config
      become: true
      template: src={{ item.src }} dest={{ item.dest }} owner={{ item.owner }} group={{ item.group|default(item.owner) }} mode={{ item.mode }}
      vars:
        etcdctl_endpoints: "{% for ip in groups[etcd_cluster]|default([]) %}{% if not loop.first %},{% endif %}https://{{ ip }}:{{ etcd_port }}{% endfor %}"
        etcdctl_user:      "root:{{ etcd_root_password }}"
      with_items:
        - { src: "etcd.conf"  ,dest: "/etc/etcd/etcd.conf"            ,owner: "etcd", group: "etcd" ,mode: "0644" }
        - { src: "etcd.pass"  ,dest: "/etc/etcd/etcd.pass"            ,owner: "root", group: "etcd" ,mode: "0640" }
        - { src: "etcd.svc"   ,dest: "{{ systemd_dir }}/etcd.service" ,owner: "root", group: "root" ,mode: "0644" }
        - { src: "etcdctl.sh" ,dest: "/etc/profile.d/etcdctl.sh"      ,owner: "root", group: "root" ,mode: "0755" }

#--------------------------------------------------------------#
# Issue etcd certs                             [etcd_cert_issue]
#--------------------------------------------------------------#
- name: generate etcd server certs
  tags: [ etcd_cert, etcd_cert_issue ]
  become: false
  connection: local
  vars:
    ansible_python_interpreter: "{{ ansible_playbook_python }}"
  block:

    - name: generate etcd private key
      connection: local
      openssl_privatekey:
        path: files/pki/etcd/{{ etcd_instance }}.key
        mode: 0600

    - name: generate etcd signing request
      connection: local
      openssl_csr:
        path: "files/pki/csr/{{ etcd_instance }}.csr"
        privatekey_path: "files/pki/etcd/{{ etcd_instance }}.key"
        common_name: "{{ etcd_instance }}"
        organization_name: pigsty
        organizational_unit_name: etcd
        #force: true
        subject_alt_name:
          - IP:127.0.0.1
          - DNS:localhost
          - "IP:{{ inventory_hostname }}"
          - "DNS:{{ etcd_instance }}"

    - name: issue etcd server certificate
      connection: local
      openssl_certificate:
        path: "files/pki/etcd/{{ etcd_instance }}.crt"
        csr_path: "files/pki/csr/{{ etcd_instance }}.csr"
        provider: ownca
        ownca_path: files/pki/ca/ca.crt
        ownca_privatekey_path: files/pki/ca/ca.key
        ownca_not_after: "+{{ cert_validity }}"
        mode: 0644


#--------------------------------------------------------------#
# Copy etcd certs                               [etcd_cert_copy]
#--------------------------------------------------------------#
- name: copy etcd certs
  tags: [ etcd_cert, etcd_cert_copy ]
  become: true
  copy: src={{ item.src }} dest={{ item.dest }} owner={{ item.owner }} group={{ item.group|default(item.owner) }} mode={{ item.mode }}
  with_items:
    - { src: "files/pki/ca/ca.crt"                    ,dest: "/etc/etcd/ca.crt"     ,owner: "etcd", group: "etcd" ,mode: "0644" }
    - { src: "files/pki/etcd/{{ etcd_instance }}.crt" ,dest: "/etc/etcd/server.crt" ,owner: "etcd", group: "etcd" ,mode: "0644" }
    - { src: "files/pki/etcd/{{ etcd_instance }}.key" ,dest: "/etc/etcd/server.key" ,owner: "etcd", group: "etcd" ,mode: "0600" }
...
