# SPDX-License-Identifier: MIT
---
# 1) If a key has been specified by the user, go with the specified key.
# 2) Otherwise generate a new random key. This is used as a default if no key
# can be slurped from existing cluster nodes.
# 3) If the user does not want to regenerate a key, try slurping an existing
# key from cluster nodes. If no node has a key, a random key generated in step
# 2 is going to be used.

- name: Retrieve from the controller key {{ preshared_key_label }}
  when:
    - preshared_key_src is string and preshared_key_src | length > 1
  run_once: true  # noqa: run_once[task]
  delegate_to: localhost
  block:
    - name: Check if key exists on the controller {{ preshared_key_label }}
      stat:
        path: "{{ preshared_key_src }}"
      register: __ha_cluster_preshared_key_stat_controller

    - name: Slurp existing key from the controller {{ preshared_key_label }}
      slurp:
        src: "{{ preshared_key_src }}"
      register: __ha_cluster_preshared_key_slurp_controller
      when: __ha_cluster_preshared_key_stat_controller.stat.exists
      # Prevent key contents to be printed to the output
      no_log: true

    - name: Use the slurped key from the controller {{ preshared_key_label }}
      set_fact:
        __ha_cluster_some_preshared_key: >
          "{{ __ha_cluster_preshared_key_slurp_controller.content }}"
      when: __ha_cluster_preshared_key_stat_controller.stat.exists
      # Prevent key contents to be printed to the output
      no_log: true

- name: Generate random key {{ preshared_key_label }}
  when:
    - not (preshared_key_src is string and preshared_key_src | length > 1)
  run_once: true  # noqa: run_once[task]
  # Prevent key contents to be printed to the output
  no_log: true
  block:
    - name: Generate key using OpenSSL {{ preshared_key_label }}
      command:
        cmd: openssl rand -base64 {{ preshared_key_length | quote }}
      register: __ha_cluster_openssl_rand
      changed_when: false

    - name: Fetch generated {{ preshared_key_label }}
      set_fact:
        __ha_cluster_some_preshared_key: >
          "{{ __ha_cluster_openssl_rand.stdout }}"

- name: Retrieve key from cluster nodes {{ preshared_key_label }}
  when:
    - not (preshared_key_src is string and preshared_key_src | length > 1)
    - not ha_cluster_regenerate_keys
  block:
    - name: Check if key exists on cluster nodes {{ preshared_key_label }}
      stat:
        path: "{{ preshared_key_dest }}"
      register: __ha_cluster_preshared_key_stat

    - name: Slurp existing key from cluster nodes {{ preshared_key_label }}
      slurp:
        src: "{{ preshared_key_dest }}"
      register: __ha_cluster_preshared_key_slurp
      when: __ha_cluster_preshared_key_stat.stat.exists
      # Prevent key contents to be printed to the output
      no_log: true

    - name: Use the slurped key from cluster nodes {{ preshared_key_label }}
      set_fact:
        __ha_cluster_some_preshared_key: >
          "{{ __ha_cluster_preshared_key_slurp.content }}"
      when: __ha_cluster_preshared_key_stat.stat.exists
      # Prevent key contents to be printed to the output
      no_log: true
      # Following variables set the fact for all nodes
      delegate_facts: true
      delegate_to: "{{ item }}"
      with_items: "{{ ansible_play_hosts }}"
