- name: Check if required facts are set
  ansible.builtin.fail:
    msg: "The following variables are required: encryption_aws_access_key_id, encryption_aws_secret_access_key, encryption_kms_arn"
  when:
    - encryption_aws_access_key_id is not defined
    - encryption_aws_secret_access_key is not defined
    - encryption_kms_arn is not defined

- name: Copy aws-encryption-provider binary to the host
  become: true
  ansible.builtin.copy:
    src: aws-encryption-provider
    dest: /usr/local/bin/aws-encryption-provider
    mode: '0755'

- name: Copy start script to the host
  become: true
  ansible.builtin.template:
    src: start-encryption-provider.sh.j2
    dest: /usr/local/bin/start-encryption-provider.sh
    mode: '0755'
    owner: root
    group: root

- name: Create KMS socket directory
  become: true
  ansible.builtin.file:
    path: /var/run/kmsplugin
    state: directory
    mode: '0755'
    owner: root
    group: root

- name: Create systemd service file for aws-encryption-provider
  become: true
  ansible.builtin.template:
    src: aws-encryption-provider.service.j2
    dest: /etc/systemd/system/aws-encryption-provider.service
    mode: '0644'

- name: Reload systemd daemon
  become: true
  ansible.builtin.systemd:
    daemon_reload: true
    name: aws-encryption-provider

- name: Enable aws-encryption-provider service
  become: true
  ansible.builtin.systemd:
    name: aws-encryption-provider
    enabled: true

- name: Start aws-encryption-provider service
  become: true
  ansible.builtin.systemd:
    name: aws-encryption-provider
    state: started