---
- block:

  - block:

    - name: Copy keystore to {{ inventory_hostname }}:{{ apigee_tls_keystore_dest }}
      copy:
        src: '{{ apigee_tls_keystore_src }}'
        dest: '{{ apigee_tls_keystore_dest }}'

    when: apigee_tls_keystore_src is not none


  - block:

    - name: Remove keystore
      file:
        path: '{{ apigee_tls_keystore_dest }}'
        state: absent

    - name: Generate keystore
      command: "{{ apigee_tls_keystore_keytool_path }} -genkeypair -keyalg RSA -sigalg SHA256withRSA -keystore {{ apigee_tls_keystore_dest }} -alias {{ apigee_tls_keystore_keyalias }} -dname CN={{ ansible_fqdn }} -ext san=dns:{{ ansible_fqdn }} -validity {{ apigee_tls_keystore_validity }} -storepass {{ apigee_tls_keystore_password }} -keypass {{ apigee_tls_keystore_password }}"

    when: apigee_tls_keystore_src is none


  - name: Set keystore ownership and permissions
    file:
      path: '{{ apigee_tls_keystore_dest }}'
      owner: apigee
      group: apigee
      mode: 0600

  become: true
  become_user: '{{ apigee_become_user }}'

---
- block:

  - block:

    - name: Copy keystore to {{ inventory_hostname }}:{{ apigee_tls_keystore_dest }}
      copy:
        src: '{{ apigee_tls_keystore_src }}'
        dest: '{{ apigee_tls_keystore_dest }}'

    when: apigee_tls_keystore_src is not none


  - block:

    - name: Remove keystore
      file:
        path: '{{ apigee_tls_keystore_dest }}'
        state: absent

    - name: Generate keystore
      command: "{{ apigee_tls_keystore_keytool_path }} -genkeypair -keyalg RSA -sigalg SHA256withRSA -keystore {{ apigee_tls_keystore_dest }} -alias {{ apigee_tls_keystore_keyalias }} -dname CN={{ ansible_fqdn }} -ext san=dns:{{ ansible_fqdn }} -validity {{ apigee_tls_keystore_validity }} -storepass {{ apigee_tls_keystore_password }} -keypass {{ apigee_tls_keystore_password }}"

    when: apigee_tls_keystore_src is none


  - name: Set keystore ownership and permissions
    file:
      path: '{{ apigee_tls_keystore_dest }}'
      owner: apigee
      group: apigee
      mode: 0400

  become: true
  become_user: '{{ apigee_become_user }}'

Set more restrictive permissions on keystore files
Set more restrictive permissions on keystore files
