---
- name: check if server cert is expiring in the next 5 days
  shell: "openssl x509 -checkend 432000 -noout -in /etc/pki/certs/nexus.crt"
  args:
    executable: /bin/bash
  failed_when: False
  check_mode: False
  changed_when: False
  register: exp

- name: get cert
  shell: "vault write pki_int/issue/{{ vault_pki_policy }} common_name=nexus.service.{{ main_dc_name }}.{{ consul_domain }} ttl=43200m"
  args:
    executable: /bin/bash
  environment:
    VAULT_ADDR: http://ivyking.minhas.io:8200
    VAULT_TOKEN: "{{ lookup('file', lookup('env', 'HOME') + '/.vault-token') }}"
    VAULT_FORMAT: json
  register: cert_data
  when: exp.rc != 0

- name: write cert data to server
  copy:
    content: "{{ item.content }}"
    dest: "/etc/pki/{{ item.path }}"
    mode: '{{ item.mode }}'
    owner: root
    group: root
  when: cert_data.changed
  loop:
    - {
        content: "{{ (cert_data.stdout | from_json).data.certificate }}",
        path: "certs/nexus.crt",
        mode: "0755"
    }
    - {
        content: "{{ (cert_data.stdout | from_json).data.private_key }}",
        path: "keys/nexus.key",
        mode: "0600"
    }
- name: ensure python-docker is installed
  apt:
    name: python3-docker
    state: present

- name: ensure nexus group exists
  group:
    name: nexus
    state: present
    gid: 200

- name: ensure nexus user exists
  user:
    name: nexus
    group: nexus
    uid: 200
    create_home: False

- name: ensure nexus ssl dir exists
  file:
    path: /etc/nexus/
    state: directory
    owner: root
    group: root
    mode: 0755

- name: ensure nexus data dir exists
  file:
    path: "{{ nexus_storage }}"
    state: directory
    owner: nexus
    group: nexus
    mode: 0755

- name: ensure nexus data dir exists
  file:
    path: "{{ nexus_config_dir }}"
    state: directory
    owner: nexus
    group: nexus
    mode: 0755

- name: ensure nexus keystore dir exists
  file:
    path: "{{ nexus_config_dir }}/etc/ssl/"
    state: directory
    owner: nexus
    group: nexus
    mode: 0755

- name: ensure keystore exists
  copy:
    content: "{{ lookup('hashi_vault', 'secret=kv/data/nexus:data')['keystore'] | b64decode }}"
    dest: "{{ nexus_config_dir }}/etc/ssl/keystore.jks"
    owner: nexus
    group: nexus
    mode: 0700

- name: template nexus.properties
  template:
    src: templates/nexus.properties.j2
    dest: "{{ nexus_storage }}/etc/nexus.properties"

- name: run nexus3
  docker_container:
    name: nexus
    image:  sonatype/nexus3
    env:
      REGISTRY_HTTP_TLS_CERTIFICATE: /certs/nexus.crt
      REGISTRY_HTTP_TLS_KEY: /certs/nexus.key
      REGISTRY_HTTP_SECRET: "{{ lookup('hashi_vault', 'secret=kv/data/nexus:data')['REGISTRY_HTTP_SECRET'] }}"
    ports:
      - "8081:8081"
    volumes:
      - "{{ nexus_storage }}:/nexus-data"
      - "{{ nexus_config_dir }}/etc/ssl:/opt/sonatype/nexus/etc/ssl/"
      - /etc/nexus:/certs
    restart_policy: always

- name: ensure nexus consul service config exists
  copy:
    src: files/nexus.hcl
    dest: /etc/consul.d/nexus.hcl
    mode: 0750
    owner: consul
    group: consul
  notify: reload consul
...