---
- name: Converge
  hosts: all
  gather_facts: false
  vars:
    custom_certificate_failure: {}
    custom_cert_name: "{{ lookup('env', 'custom_cert_name') }}"
    cust_crt_name_pass: "{{ lookup('env', 'custom_cert_name_pass') }}"
    import_cert_path: "{{ lookup('env', 'path_for_import_cert') }}"

  tasks:
    - name: Fetching firmware version for IDRAC
      ansible.builtin.include_tasks:
        file: ../__extract_firmware_version.yml
      vars:
        idrac_ip: "{{ lookup('env', 'IDRAC_IP') }}"
        idrac_user: "{{ lookup('env', 'IDRAC_USER') }}"
        idrac_password: "{{ lookup('env', 'IDRAC_PASSWORD') }}"

    - name: Set expected firmware version
      ansible.builtin.set_fact:
        firmware_version_expected: "6.10.80.00"
        firmware_version_expected_export: "7.00.00.00"

    - name: Import CUSTOMCERTIFICATE without passphrase
      when: idrac_certificate_firmware_version is defined and
             "idrac_certificate_firmware_version >= firmware_version_expected"
             and custom_cert_name
      block:
        - name: Fetching Custom certificate from share
          ansible.builtin.include_tasks:
            file: ../__get_helper.yml
          vars:
            idrac_cert_name:
              - "{{ custom_cert_name }}"

        - name: Import a custom certificate
          ansible.builtin.import_role:
            name: dellemc.openmanage.idrac_certificate
          vars:
            hostname: "{{ lookup('env', 'IDRAC_IP') }}"
            username: "{{ lookup('env', 'IDRAC_USER') }}"
            password: "{{ lookup('env', 'IDRAC_PASSWORD') }}"
            validate_certs: false
            command: "import"
            certificate_type: "CUSTOMCERTIFICATE"
            certificate_path: "{{ import_cert_path }}{{ custom_cert_name }}"
            passphrase: ""

        - name: Waiting for idrac readiness
          ansible.builtin.wait_for:
            timeout: 60
          when:
            - not ansible_check_mode
            - idrac_certificate_out is defined
            - idrac_certificate_out.changed

        - name: Asserting operation with check mode.
          ansible.builtin.assert:
            that: idrac_certificate_out.msg == "Changes found to be applied."
          when: ansible_check_mode

        - name: Asserting operation with Normal/Idempotence mode.
          ansible.builtin.assert:
            that: idrac_certificate_out.msg == "Successfully performed the
                                           'import' certificate operation.iDRAC
                                            has been reset successfully."
          when: not ansible_check_mode and idrac_certificate_out.changed

      rescue:
        - name: Set the failure messages for CUSTOMECERT
          ansible.builtin.set_fact:
            custom_certificate_failure: "{{  custom_certificate_failure |
                           combine({'CUSTOMCERTIFICATE_WITHOUT_PASS_IMPORT':
                           {'msg': ansible_failed_result.msg,
                           'failed_task_name': ansible_failed_task.name}}) }}"
      always:
        - name: Deleting the directory
          ansible.builtin.include_tasks:
            file: ../__delete_directory.yml

    - name: Export CUSTOMCERTIFICATE
      when:
        - idrac_certificate_firmware_version is defined
        - "idrac_certificate_firmware_version >=
           firmware_version_expected_export"
      block:
        - name: Fetching Custom certificate from share
          ansible.builtin.include_tasks:
            file: ../__get_helper.yml
          vars:
            idrac_cert_name:
              - "{{ custom_cert_name }}"

        - name: Export a custom certificate
          ansible.builtin.import_role:
            name: dellemc.openmanage.idrac_certificate
          vars:
            hostname: "{{ lookup('env', 'IDRAC_IP') }}"
            username: "{{ lookup('env', 'IDRAC_USER') }}"
            password: "{{ lookup('env', 'IDRAC_PASSWORD') }}"
            validate_certs: false
            command: "export"
            certificate_type: "CUSTOMCERTIFICATE"
            certificate_path: "{{ import_cert_path }}"
          when: not ansible_check_mode

        - name: Setting up CustomCertificate certificate path for exported file
          when: idrac_certificate_out is defined
                 and idrac_certificate_out.certificate_path is defined
          ansible.builtin.stat:
            path: "{{ idrac_certificate_out.certificate_path }}"
          register: csc_cert_file
          no_log: true

        - name: Asserting operation with Normal/Idempotence mode.
          ansible.builtin.assert:
            that:
              - csc_cert_file.stat.exists
              - not idrac_certificate_out.changed
              - not idrac_certificate_out.failed
              - idrac_certificate_out.msg == "Successfully performed the
                                             'export' certificate operation."
          when: not ansible_check_mode and not idrac_certificate_out.changed

      rescue:
        - name: Set the failure messages for CUSTOMECERT
          ansible.builtin.set_fact:
            custom_certificate_failure: "{{  custom_certificate_failure |
                                         combine({'CUSTOMCERTIFICATE_EXPORT':
                                         {'msg': ansible_failed_result.msg,
                            'failed_task_name': ansible_failed_task.name}}) }}"

      always:
        - name: Deleting the directory
          ansible.builtin.include_tasks:
            file: ../__delete_directory.yml

    - name: Import CUSTOMCERTIFICATE with passphrase
      when: idrac_certificate_firmware_version is defined and
             "idrac_certificate_firmware_version >= firmware_version_expected"
             and cust_crt_name_pass
      block:
        - name: Fetching Custom certificate from share
          ansible.builtin.include_tasks:
            file: ../__get_helper.yml
          vars:
            idrac_cert_name:
              - "{{ cust_crt_name_pass }}"

        - name: Import a custom certificate with passphrase
          ansible.builtin.import_role:
            name: dellemc.openmanage.idrac_certificate
          vars:
            hostname: "{{ lookup('env', 'IDRAC_IP') }}"
            username: "{{ lookup('env', 'IDRAC_USER') }}"
            password: "{{ lookup('env', 'IDRAC_PASSWORD') }}"
            validate_certs: false
            command: "import"
            certificate_type: "CUSTOMCERTIFICATE"
            certificate_path: "{{ import_cert_path }}{{ cust_crt_name_pass }}"
            passphrase: "{{ lookup('env', 'passphrase') }}"

        - name: Asserting operation with check mode.
          ansible.builtin.assert:
            that: idrac_certificate_out.msg == "Changes found to be applied."
          when: ansible_check_mode

        - name: Waiting for idrac readiness
          ansible.builtin.wait_for:
            timeout: 60
          when:
            - not ansible_check_mode
            - idrac_certificate_out is defined
            - idrac_certificate_out.changed

        - name: Asserting operation with Normal/Idempotence mode.
          ansible.builtin.assert:
            that: idrac_certificate_out.msg == "Successfully performed the
                         'import' certificate operation.iDRAC
                          has been reset successfully."
          when: not ansible_check_mode and idrac_certificate_out.changed

      rescue:
        - name: Set the failure messages for CUSTOMECERT
          ansible.builtin.set_fact:
            custom_certificate_failure: "{{  custom_certificate_failure |
                           combine({'CUSTOMCERTIFICATE_WITH_PASS_IMPORT':
                           {'msg': ansible_failed_result.msg,
                           'failed_task_name': ansible_failed_task.name}}) }}"

      always:
        - name: Deleting the directory
          ansible.builtin.include_tasks:
            file: ../__delete_directory.yml

    - name: Collecting failure
      ansible.builtin.debug:
        var: custom_certificate_failure
      when: custom_certificate_failure
      failed_when: true
