factorize the `when` condition

roles/generate-cert/tasks/main.yml

@@ -22,18 +22,18 @@
   register: validity
   when: cert_file.stat.exists
 
-# TODO: Use a block to have only one `when`
-- name: Generate private key
+- name:  Generate the certificate
+  block:
+    - name: Generate private key
       become: false
       openssl_privatekey:
         path: "/tmp/ansible_hacky_pki_{{ cname }}.key"
         mode: u=rw,g=,o=
         size: "{{ key_size | default(omit) }}"
       delegate_to: localhost
-  when: force_renewal or (not key_file.stat.exists) or (not cert_file.stat.exists) or (not validity.valid_at.renewal)
     
-# TODO: add a revocation methode, most probably crl, with crl_distribution_points
-- name: Generate a Certificate Signing Request
+    # TODO: add a revocation methode, most probably crl, with crl_distribution_points
+    - name: Generate a Certificate Signing Request
       become: false
       openssl_csr:
         path: "/tmp/ansible_hacky_pki_{{ cname }}.csr"
@@ -52,17 +52,15 @@
         key_usage_critical: yes
         subject_alt_name: "{{ subject_alt_name | default(omit) }}"
       delegate_to: localhost
-  when: force_renewal or (not key_file.stat.exists) or (not cert_file.stat.exists) or (not validity.valid_at.renewal)
     
-- name: Put the CA in a file
+    - name: Put the CA in a file
       become: false
       copy:
         content: "{{ ca_cert }}"
         dest: "/tmp/ansible_hacky_pki_ca.crt"
       delegate_to: localhost
-  when: force_renewal or (not key_file.stat.exists) or (not cert_file.stat.exists) or (not validity.valid_at.renewal)
     
-- name: Put the CA key in a file
+    - name: Put the CA key in a file
       become: false
       copy:
         content: "{{ ca_key }}"
@@ -70,9 +68,8 @@
         mode: u=rw,g=,o=
       delegate_to: localhost
       no_log: yes
-  when: force_renewal or (not key_file.stat.exists) or (not cert_file.stat.exists) or (not validity.valid_at.renewal)
     
-- name: Sign the certificate
+    - name: Sign the certificate
       become: false
       openssl_certificate:
         path: "/tmp/ansible_hacky_pki_{{ cname }}.crt"
@@ -83,9 +80,8 @@
         ownca_privatekey_path: /tmp/ansible_hacky_pki_ca.key
         provider: ownca
       delegate_to: localhost
-  when: force_renewal or (not key_file.stat.exists) or (not cert_file.stat.exists) or (not validity.valid_at.renewal)
     
-- name: Send private key to the server
+    - name: Send private key to the server
       copy:
         src: "/tmp/ansible_hacky_pki_{{ cname }}.key"
         dest: "{{ directory }}/{{ cname }}.key"
@@ -93,54 +89,48 @@
         group: "{{ group | default('root') }}"
         mode: "{{ key_mode | default('u=rw,g=,o=') }}"
       no_log: yes
-  when: force_renewal or (not key_file.stat.exists) or (not cert_file.stat.exists) or (not validity.valid_at.renewal)
     
-- name: Send certificate to the server
+    - name: Send certificate to the server
       copy:
         src: "/tmp/ansible_hacky_pki_{{ cname }}.crt"
         dest: "{{ directory }}/{{ cname }}.crt"
         owner: "{{ owner | default('root') }}"
         group: "{{ group | default('root') }}"
         mode: "{{ key_mode | default('u=rw,g=r,o=r') }}"
-  when: force_renewal or (not key_file.stat.exists) or (not cert_file.stat.exists) or (not validity.valid_at.renewal)
     
-# Clean up
-- name: Remove the local cert key
+    # Clean up
+    - name: Remove the local cert key
       become: false
       file:
         path: "/tmp/ansible_hacky_pki_{{ cname }}.key"
         state: absent
       delegate_to: localhost
-  when: force_renewal or (not key_file.stat.exists) or (not cert_file.stat.exists) or (not validity.valid_at.renewal)
     
-- name: Remove the CSR
+    - name: Remove the CSR
       become: false
       file:
         path: "/tmp/ansible_hacky_pki_{{ cname }}.csr"
         state: absent
       delegate_to: localhost
-  when: force_renewal or (not key_file.stat.exists) or (not cert_file.stat.exists) or (not validity.valid_at.renewal)
     
-- name: Remove the local certificate
+    - name: Remove the local certificate
       become: false
       file:
         path: "/tmp/ansible_hacky_pki_{{ cname }}.crt"
         state: absent
       delegate_to: localhost
-  when: force_renewal or (not key_file.stat.exists) or (not cert_file.stat.exists) or (not validity.valid_at.renewal)
     
-- name: Remove the CA certificate
+    - name: Remove the CA certificate
       become: false
       file:
         path: /tmp/ansible_hacky_pki_ca.crt
         state: absent
       delegate_to: localhost
-  when: force_renewal or (not key_file.stat.exists) or (not cert_file.stat.exists) or (not validity.valid_at.renewal)
     
-- name: Remove the CA key
+    - name: Remove the CA key
       become: false
       file:
         path: /tmp/ansible_hacky_pki_ca.key
         state: absent
       delegate_to: localhost
-  when: not key_file.stat.exists
+  when: force_renewal or (not key_file.stat.exists) or (not cert_file.stat.exists) or (not validity.valid_at.renewal)