---
- name: generate certificates for use with filebeat
  hosts: localhost
  tasks:
    - name: generate private key
      command: openssl genpkey -algorithm RSA -out logstash-{{ stack_name }}-private.key
      args:
        creates: logstash-{{ stack_name }}-private.key
    - name: generate certificate signing request
      shell: >-
        openssl req -new -key logstash-{{ stack_name }}-private.key
        -out logstash-{{ stack_name }}.csr
        -subj "/CN={{ logstash_host_ip_address }}"
        -reqexts SAN
        -config <(cat /etc/ssl/openssl.cnf <(printf "[SAN]\nsubjectAltName=IP:{{ logstash_host_ip_address }}"))
      args:
        creates: logstash-{{ stack_name }}.csr
    - name: generate self-signed certificate
      shell: >-
        openssl x509 -req -days 3650
        -in logstash-{{ stack_name }}.csr
        -signkey logstash-{{ stack_name }}-private.key
        -out logstash-{{ stack_name }}-public.crt
        -extfile <(printf "subjectAltName=IP:{{ logstash_host_ip_address }}")
      args:
        creates: logstash-{{ stack_name }}-public.crt

- name: copy certificates to logstash machines
  hosts: all
  become: False
  tasks:
    - name: copy logstash public certificate to logstash servers
      copy:
        src: logstash-{{ stack_name }}-public.crt
        dest: /tmp/logstash-{{ stack_name }}-public.crt
        mode: 0644
    - name: copy logstash private key to logstash servers
      copy:
        src: logstash-{{ stack_name }}-private.key
        dest: /tmp/logstash-{{ stack_name }}-private.key
        mode: 0644

- name: provision a logstash setup
  hosts: all
  become: True
  roles:
    - logstash
    - log_forwarding
