---
# file: roles/incus/tasks/trust.yml

- name: "/usr/local/etc/tls/incus_trust/"
  ansible.builtin.file:
    path: "/usr/local/etc/tls/incus_trust/"
    state: directory

- name: "local copy of certificate for trusted hosts"
  ansible.builtin.copy:
    content: "{{ lookup('hashi_vault', 'secret=talas-kv/data/' + host_vars_location + '/' + item)['alexandria_crt'] }}"
    dest: "/usr/local/etc/tls/incus_trust/{{ item }}.crt"
  loop: "{{ incus_trust_list }}"
  register: certificate_copy

- name: "add trusted host"
  ansible.builtin.command: "incus config trust add-certificate /usr/local/etc/tls/incus_trust/{{ item.item }}.crt"
  when: item.changed
  loop: "{{ certificate_copy.results }}"
