---
- name: "create site data directory for {{ site }}"
  file:
    path: "/srv/web/{{ site }}"
    state: directory
    mode: 0755
    owner: root
    group: "{{ ansible_wheel }}"
  when: redirect is not defined and proxy is not defined

- name: "create site config for {{ site }}"
  template:
    dest: /etc/nginx/conf.d/{{ site }}.conf
    src: site.conf.j2
    mode: 0644
    owner: root
    group: "{{ ansible_wheel }}"
  notify: restart nginx

- name: "copy site private key for {{ site }}"
  copy:
    dest: "{{ tls_private }}/{{ site }}.key"
    src: "{{ item }}"
    mode: 0600
    owner: root
    group: "{{ ansible_wheel }}"
  with_first_found:
    - "/srv/letsencrypt/live/{{ site }}/privkey.pem"
    - "/srv/ca/private/{{ site }}.key"
    - "/srv/ca/private/{{ inventory_hostname }}.key"
  tags: certificates
  notify: restart nginx

- name: "copy site certificate for {{ site }}"
  copy:
    src: "{{ item }}"
    dest: "{{ tls_certs }}/{{ site }}-fullchain.crt"
    mode: 0644
    owner: root
    group: "{{ ansible_wheel }}"
    validate: /usr/bin/openssl x509 -in %s -noout
  with_first_found:
    - "/srv/letsencrypt/live/{{ site }}/fullchain.pem"
    - "/srv/ca/certs/hosts/{{ site }}.crt"
    - "/srv/ca/certs/hosts/{{ inventory_hostname }}.crt"
  tags: certificates
  notify: restart nginx