---
- name: 在成员本地生成私钥
  community.crypto.openssl_privatekey:
    path: "{{ etcd_config_dir }}/{{ etcd_cert.name }}.key"
    type: ECC
    curve: secp256r1
    owner: root
    group: "{{ etcd_cert.group }}"
    mode: '0640'

- name: 本地生成 CSR
  community.crypto.openssl_csr:
    path: "{{ etcd_config_dir }}/{{ etcd_cert.name }}.csr"
    privatekey_path: "{{ etcd_config_dir }}/{{ etcd_cert.name }}.key"
    common_name: "{{ etcd_cert.cn | default(omit, true) }}"
    subject_alt_name: >-
      {{ ['IP:' ~ etcd_address, 'DNS:' ~ inventory_hostname] if etcd_cert.name in ['server', 'peer']
         else (['DNS:' ~ inventory_hostname] if etcd_cert.name == 'gateway' else []) }}
    use_common_name_for_san: false
    extended_key_usage: "{{ etcd_cert.eku }}"
    key_usage: [digitalSignature]
    mode: '0644'
  register: etcd_csr_state

- name: 检查已有证书
  ansible.builtin.stat:
    path: "{{ etcd_config_dir }}/{{ etcd_cert.name }}.crt"
  register: etcd_cert_file

- name: 检查续签窗口
  community.crypto.x509_certificate_info:
    path: "{{ etcd_config_dir }}/{{ etcd_cert.name }}.crt"
    valid_at:
      renewal: "{{ etcd_renew_before }}"
  register: etcd_cert_info
  when: etcd_cert_file.stat.exists

- name: 通过中央 CA 签发需更新的证书
  when: >-
    not etcd_cert_file.stat.exists or etcd_csr_state is changed or
    not (etcd_cert_info.valid_at.renewal | default(false))
  block:
    - name: 仅在确需签发时要求 Bao 凭据
      ansible.builtin.assert:
        that: etcd_bao_token | length > 0
      no_log: true

    - name: 读取 CSR 公共内容
      ansible.builtin.slurp:
        src: "{{ etcd_config_dir }}/{{ etcd_cert.name }}.csr"
      register: etcd_csr

    - name: 控制端提交 Bao 签名请求
      ansible.builtin.uri:
        url: "{{ etcd_bao_url }}/v1/{{ etcd_bao_pki_mount }}/sign/{{ etcd_cert.role }}"
        method: POST
        headers:
          X-Vault-Token: "{{ etcd_bao_token }}"
        body_format: json
        body:
          csr: "{{ etcd_csr.content | b64decode }}"
          ttl: "{{ etcd_certificate_ttl }}"
        status_code: 200
      delegate_to: localhost
      become: false
      register: etcd_signed
      no_log: true
      when: not ansible_check_mode

    - name: 保存签发的证书链
      ansible.builtin.copy:
        content: |
          {{ etcd_signed.json.data.certificate }}
          {{ etcd_signed.json.data.ca_chain | join('\n') }}
        dest: "{{ etcd_config_dir }}/{{ etcd_cert.name }}.crt"
        owner: root
        group: "{{ etcd_cert.group }}"
        mode: '0644'
      when: not ansible_check_mode

    - name: 保存中央 CA 信任链
      ansible.builtin.copy:
        content: |
          {{ etcd_signed.json.data.ca_chain | join('\n') }}
        dest: "{{ etcd_config_dir }}/ca.crt"
        owner: root
        group: homelab-etcd
        mode: '0644'
      when: not ansible_check_mode

    - name: 标记证书已更新
      ansible.builtin.set_fact:
        etcd_certificates_changed: true