---
- name: get latest easy-rsa release info
  ansible.builtin.uri:
    url: https://api.github.com/repos/OpenVPN/easy-rsa/releases/latest
    return_content: true
  register: easyrsa_release
  run_once: true
  check_mode: false

- name: set current easy-rsa version
  ansible.builtin.set_fact:
    easyrsa_version: "{{ easyrsa_release.json.tag_name | replace('v', '') }}"
    easyrsa_asset_url: "{{ easyrsa_release.json.assets | selectattr('name', 'search', 'EasyRSA.*\\.tgz') | map(attribute='browser_download_url') | first }}"

- name: check easy-rsa installed version
  ansible.builtin.command: /opt/easy-rsa/easyrsa version
  register: easyrsa_current_version
  changed_when: false
  failed_when: false

- name: ensure easy-rsa directory exists
  ansible.builtin.file:
    path: /opt/easy-rsa
    state: directory
    mode: '0755'
  check_mode: false

- name: update easy-rsa
  ansible.builtin.unarchive:
    src: "{{ easyrsa_asset_url }}"
    dest: /opt/easy-rsa
    remote_src: true
    extra_opts:
      - --strip-components=1
  when: easyrsa_version not in (easyrsa_current_version.stdout | default(''))