---
# file: roles/ssh-keygen-and-store/tasks/from_hashicorp_to_server.yml

- name: "make sure the .ssh directory exists"
  file:
    path: "{{ getent_passwd[item[0].item][4] }}/.ssh"
    state: directory
    owner: "{{ item[0].item }}"
    group: "{{ item[0].item }}"
  tags: ssh-keygen

- name: "copy private key from hashicorp vault to server"
  copy:
    dest: "{{ getent_passwd[item[0].item][4] }}/.ssh/id_ed25519"
    content: "{{ lookup('hashi_vault', 'secret=talas-kv/data/' + host_vars_location + '/' + ansible_hostname)['ssh_key_ed25519_' + item[0].item] + '\n' }}"
    owner: "{{ item[0].item }}"
    group: "{{ item[0].item }}"
    mode: 0600
  tags: ssh-keygen

- name: "copy public key from hashicorp vault to server"
  copy:
    dest: "{{ getent_passwd[item[0].item][4] }}/.ssh/id_ed25519.pub"
    content: "{{ lookup('hashi_vault', 'secret=talas-kv/data/' + host_vars_location + '/' + ansible_hostname)['ssh_key_ed25519_' + item[0].item + '_pub'] + '\n' }}"
    owner: "{{ item[0].item }}"
    group: "{{ item[0].item }}"
    mode: 0644
  tags: ssh-keygen
