- name: Copy aws-encryption-provider binary to the host
  become: true
  ansible.builtin.copy:
    src: aws-encryption-provider
    dest: /usr/local/bin/aws-encryption-provider
    mode: "0755"

- name: Create KMS socket directory
  become: true
  ansible.builtin.file:
    path: /var/run/kmsplugin
    state: directory
    mode: "0755"
    owner: root
    group: root

- name: Create systemd service file for aws-encryption-provider
  become: true
  ansible.builtin.template:
    src: aws-encryption-provider.service.j2
    dest: /etc/systemd/system/aws-encryption-provider.service
    mode: "0644"

- name: Reload systemd daemon
  become: true
  ansible.builtin.systemd:
    daemon_reload: true
    name: aws-encryption-provider

- name: Enable aws-encryption-provider service
  become: true
  ansible.builtin.systemd:
    name: aws-encryption-provider
    enabled: true

- name: Start aws-encryption-provider service
  become: true
  ansible.builtin.systemd:
    name: aws-encryption-provider
    state: started