---
- name: Create empty list for CA hosts
  ansible.builtin.set_fact:
    nebula_ca_hosts: []

- name: Find every nebula host based on their host vars
  ansible.builtin.set_fact:
    nebula_ca_hosts: "{{ nebula_ca_hosts + [item] }}"
  when: hostvars[item]['nebula_is_ca']|bool

- name: Check that there is only ONE CA host
  ansible.builtin.assert:
    that:
      - nebula_ca_hosts|length == 1
    success_msg: "One CA host found: {{ nebula_ca_hosts[0] }}"
    fail_msg: "There is either more than zero or more than one CA hosts"

- name: Ensure that nebula_ca_host is set
  ansible.builtin.set_fact:
    nebula_ca_host: "{{ nebula_ca_hosts[0] }}"
...