---
- name: Install certbot
  ansible.builtin.apt:
    name: certbot
    state: present

- name: Check if certificate already exists
  ansible.builtin.stat:
    path: "/etc/letsencrypt/live/{{ certbot_domains[0] }}/fullchain.pem"
  register: certbot_cert

- name: Stop Stalwart for initial cert issuance
  ansible.builtin.service:
    name: stalwart
    state: stopped
  when: not certbot_cert.stat.exists

- name: Obtain certificate (standalone)
  ansible.builtin.command:
    cmd: >
      certbot certonly --standalone
      --non-interactive
      --agree-tos
      --email {{ certbot_email }}
      {% for domain in certbot_domains %}-d {{ domain }} {% endfor %}
  when: not certbot_cert.stat.exists
  changed_when: true

- name: Start Stalwart after cert issuance
  ansible.builtin.service:
    name: stalwart
    state: started
  when: not certbot_cert.stat.exists

- name: Grant stalwart read access to certs
  ansible.builtin.file:
    path: "{{ item }}"
    state: directory
    mode: "0755"
  loop:
    - /etc/letsencrypt/live
    - /etc/letsencrypt/archive

- name: Deploy Stalwart admin password for renewal hook
  ansible.builtin.copy:
    dest: /etc/letsencrypt/.stalwart-admin-pass
    content: "{{ stalwart_fallback_admin_password }}"
    owner: root
    group: root
    mode: "0600"

- name: Deploy certbot renewal hook
  ansible.builtin.copy:
    dest: /etc/letsencrypt/renewal-hooks/deploy/stalwart.sh
    content: |
      #!/bin/bash
      DOMAIN="{{ certbot_domains[0] }}"
      PASS=$(cat /etc/letsencrypt/.stalwart-admin-pass)

      python3 -c "
      import json, urllib.request

      cert = open('/etc/letsencrypt/live/$DOMAIN/fullchain.pem').read()
      key = open('/etc/letsencrypt/live/$DOMAIN/privkey.pem').read()
      body = json.dumps([{'type':'insert','assert_empty':False,'values':[
        ['certificate.default.cert', cert],
        ['certificate.default.private-key', key],
      ]}]).encode()

      import base64
      auth = base64.b64encode(('admin:' + open('/etc/letsencrypt/.stalwart-admin-pass').read().strip()).encode()).decode()

      req = urllib.request.Request('http://127.0.0.1:8080/api/settings', data=body,
        headers={'Content-Type':'application/json','Authorization':'Basic ' + auth}, method='POST')
      urllib.request.urlopen(req)

      req = urllib.request.Request('http://127.0.0.1:8080/api/reload',
        headers={'Authorization':'Basic ' + auth})
      urllib.request.urlopen(req)
      "
    mode: "0755"

- name: Ensure certbot renewal timer is enabled
  ansible.builtin.systemd:
    name: certbot.timer
    enabled: true
    state: started