---
- name: ensure docker repo cert directory exists
  file:
    path: /etc/docker-repo/certs
    recurse: True
    state: directory
    owner: root
    group: root
    mode: 0755

- name: ensure docker data directory exists
  file:
    path: '{{ docker_repo_storage }}'
    recurse: True
    state: directory
    owner: root
    group: root
    mode: 0755

- name: check if server cert is expiring in the next 5 days
  shell: "openssl x509 -checkend 432000 -noout -in /etc/docker-repo/certs/docker-repo.crt"
  args:
    executable: /bin/bash
  failed_when: False
  check_mode: False
  changed_when: False
  register: exp

- name: get cert
  shell: "vault write pki_int/issue/{{ vault_pki_policy }} common_name=docker-repo.service.{{ consul_domain }} alt_names=docker-repo.service.{{ main_dc_name }}.{{ consul_domain }} ttl=43200m"
  args:
    executable: /bin/bash
  environment:
    VAULT_ADDR: https://vault.service.masked.name:8200
    VAULT_TOKEN: "{{ lookup('file', lookup('env', 'HOME') + '/.vault-token') }}"
    VAULT_FORMAT: json
  register: cert_data
  when: exp.rc != 0

- name: write cert data to server
  copy:
    content: "{{ item.content }}"
    dest: "/etc/docker-repo/{{ item.path }}"
    mode: '{{ item.mode }}'
    owner: root
    group: root
  when: cert_data.changed
  register: cert_written
  loop:
    - {
        content: "{{ (cert_data.stdout | from_json).data.certificate }}",
        path: "certs/docker-repo.crt",
        mode: "0755"
    }
    - {
        content: "{{ (cert_data.stdout | from_json).data.private_key }}",
        path: "certs/docker-repo.key",
        mode: "0600"
    }

- name: ensure python-docker is installed
  apt:
    name: python3-docker
    state: present

- name: ensure docker repo data dir exists
  file:
    path: "{{ docker_repo_storage }}"
    state: directory
    mode: 0755

- name: run docker-repo
  docker_container:
    name: docker-repo
    image: registry:2
    env:
      REGISTRY_HTTP_TLS_CERTIFICATE: /certs/docker-repo.crt
      REGISTRY_HTTP_TLS_KEY: /certs/docker-repo.key
    ports:
      - "5000:5000"
    volumes:
      - "{{ docker_repo_storage }}:/data"
      - "/etc/docker-repo/certs:/certs"
    restart_policy: always

- name: ensure docker repo service config exists
  copy:
    src: files/docker-repo.hcl
    dest: /etc/consul.d/docker-repo.hcl
    mode: 0750
    owner: consul
    group: consul
  notify: reload consul
...