---
- block:
#  - name: Create the acme hooks directory if it does not yet exist
#    file: dest={{ letsencrypt_acme_services_scripts_dir }} state=directory owner=root group=root

#  - name: Install a script that fix the letsencrypt certificate for ipa and then reload the service
#    template: src=ipa-letsencrypt-acmetool.sh dest={{ letsencrypt_acme_services_scripts_dir }}/ipa owner=root group=root mode=4555

  - name: Create the ipa certificate directory
    file: dest=/etc/pki/ipa state=directory owner=root group=root mode=0750

  - name: Install the Letsencrypt CA file with both the root and the trusted CAs
    copy: src={{ ipa_letsencrypt_ca_filename }} dest=/etc/pki/ipa/{{ ipa_letsencrypt_ca_filename }} mode=0444

  when:
    - ipa_ssl_letsencrypt_managed
    - letsencrypt_acme_install
  tags: [ 'ipa', 'letsencrypt', 'ipa_letsencrypt' ]

- block:
  - name: Install the FreeIPA server packages
    yum: pkg={{ ipa_server_packages }} state=present

  - name: Install the FreeIPA DNS server packages
    yum: pkg={{ ipa_server_dns_packages }} state=present

  when:
    - ipa_server_install
    - ansible_distribution_file_variety == "RedHat"

  tags: [ 'ipa' ]