---
- name: Ensure mTLS directories exist
  ansible.builtin.file:
    path: "{{ item.path }}"
    state: directory
    owner: root
    group: root
    mode: "{{ item.mode }}"
  loop:
    - { path: "{{ mtls_ca_directory }}", mode: "0755" }
    - { path: "{{ mtls_cert_directory }}", mode: "0755" }
    - { path: "{{ mtls_private_directory }}", mode: "0700" }
  tags: [mtls, pki]

- name: Deploy trusted CA certificates
  ansible.builtin.copy:
    src: "{{ item.src }}"
    dest: "{{ mtls_ca_directory }}/{{ item.name }}"
    owner: root
    group: root
    mode: "0644"
  loop: "{{ mtls_ca_certificates }}"
  notify: update ca certificates
  no_log: "{{ item.no_log | default(false) }}"
  tags: [mtls, pki]

- name: Deploy host certificates
  ansible.builtin.copy:
    src: "{{ item.src }}"
    dest: "{{ mtls_cert_directory }}/{{ item.name }}"
    owner: root
    group: root
    mode: "0644"
  loop: "{{ mtls_host_certificates }}"
  no_log: "{{ item.no_log | default(false) }}"
  tags: [mtls, pki]

- name: Deploy host private keys
  ansible.builtin.copy:
    src: "{{ item.src }}"
    dest: "{{ mtls_private_directory }}/{{ item.name }}"
    owner: root
    group: root
    mode: "0600"
  loop: "{{ mtls_private_keys }}"
  no_log: true
  tags: [mtls, pki]