---
- name: Verify that there isn't a CA key already
  ansible.builtin.stat:
    path: "{{ nebula_config_dir }}/ca.key"
  register: ca_key_check

- name: Verify that there isn't a CA cert already
  ansible.builtin.stat:
    path: "{{ nebula_config_dir }}/ca.crt"
  register: ca_cert_check

- name: Create a nebula CA certificate
  ansible.builtin.command:
    cmd: '{{ nebula_bin_dir }}/nebula-cert ca -name "{{ nebula_ca_name }}" -duration {{ nebula_ca_duration }} -out-key {{ nebula_config_dir }}/ca.key -out-crt {{ nebula_config_dir }}/ca.crt'
    creates: "{{ nebula_config_dir }}/ca.key"
  when:
    - not ca_key_check.stat.exists|bool
    - not ca_cert_check.stat.exists|bool

- name: Perform steps for non-ansible members
  when: nebula_nonmanaged_member_certs | length > 0
  block:
    - name: Write out the public keys of non-ansible members if needed
      delegate_to: "{{ nebula_ca_host }}"
      ansible.builtin.copy:
        dest: "{{ nebula_config_dir }}/{{ item.key }}.pub"
        content: "{{ item.value['public_key'] }}"
        mode: '0600'
      when: item.value['public_key'] is defined
      loop: "{{ nebula_nonmanaged_member_certs | dict2items }}"

    - name: Create nebula certs for non-ansible members
      ansible.builtin.template:
        src: non-managed.sh.j2
        dest: "/var/tmp/{{ item.key }}-generator.sh"
        mode: "0755"
        owner: root
        group: root
      loop: "{{ nebula_nonmanaged_member_certs | dict2items }}"

    - name: Run the generator
      ansible.builtin.command:
        cmd: "/bin/bash /var/tmp/{{ item.key }}-generator.sh"
        creates: "{{ nebula_config_dir }}/{{ item.key }}.crt"
      loop: "{{ nebula_nonmanaged_member_certs | dict2items }}"

    - name: Create an archive of certs that do not have a private key
      community.general.archive:
        format: zip
        path:
          - "{{ nebula_config_dir }}/ca.crt"
          - "{{ nebula_config_dir }}/{{ item.key }}.crt"
        dest: "{{ nebula_config_dir }}/{{ item.key }}.zip"
        mode: '0600'
        owner: root
        group: root
      when: item.value['public_key'] is defined
      loop: "{{ nebula_nonmanaged_member_certs | dict2items }}"

    - name: Create an archive of certs that do have a private key
      community.general.archive:
        format: zip
        path:
          - "{{ nebula_config_dir }}/ca.crt"
          - "{{ nebula_config_dir }}/{{ item.key }}.crt"
          - "{{ nebula_config_dir }}/{{ item.key }}.key"
        dest: "{{ nebula_config_dir }}/{{ item.key }}.zip"
        mode: '0600'
        owner: root
        group: root
      when: item.value['public_key'] is not defined
      loop: "{{ nebula_nonmanaged_member_certs | dict2items }}"

    - name: Copy the nonmanaged certs
      ansible.builtin.fetch:
        src: "{{ nebula_config_dir }}/{{ item.key }}.zip"
        dest: "{{ nebula_nonmanaged_certs_download_dir }}/{{ item.key }}.zip"
        flat: true
      loop: "{{ nebula_nonmanaged_member_certs | dict2items }}"
...