---
- name: Docker TLS directory
  file: 
    path: /etc/docker/tls 
    state: directory

- name: Openssl docker ext config file
  copy:
    content: "subjectAltName = DNS:{{ ansible_fqdn}},IP:127.0.0.1"
    dest: "/etc/docker/tls/extfile.cnf"

- name: Generate server CA and server TLS certificates
  shell: |
    openssl req -new -days 7300 -batch -newkey rsa:4096 -keyout ca.key -nodes -subj "/commonName={{ ansible_fqdn }} docker CA/" -x509 -out ca.pem
    openssl genrsa -out server.key 4096
    openssl req -subj "/CN={{ ansible_fqdn }}" -sha256 -new -key server.key -out server.csr
    openssl x509 -req -days 3650 -sha256 -in server.csr -CA ca.pem -CAkey ca.key -CAcreateserial -out server.pem -extfile extfile.cnf
  args:
    chdir: /etc/docker/tls
    creates: /etc/docker/tls/*.pem

- name: TLS client extfile
  copy:
    content: "extendedKeyUsage = clientAuth" 
    dest: /etc/docker/tls/client-extfile.cnf

- name: Docker client certificate directory
  file: 
    path: "/root/.docker/{{ ansible_fqdn }}"
    state: directory

- name: Generate and sign client TLS certificate
  shell: |
    openssl genrsa -out "/root/.docker/{{ ansible_fqdn }}/key.pem" 4096
    openssl req -subj '/CN=client' -new -key "/root/.docker/{{ ansible_fqdn }}/key.pem" -out "/root/.docker/{{ ansible_fqdn }}/client.csr"
    openssl x509 -req -days 3650 -sha256 -in "/root/.docker/{{ ansible_fqdn }}/client.csr" -CA ca.pem -CAkey ca.key -CAcreateserial -out "/root/.docker/{{ ansible_fqdn }}/cert.pem" -extfile client-extfile.cnf 
    cp /etc/docker/tls/ca.pem "/root/.docker/{{ ansible_fqdn }}"
  args:
    chdir: /etc/docker/tls
    creates: "/root/.docker/{{ ansible_fqdn }}/cert.pem"