---
- block:
    - name: Display the invocation environment
      shell: >
            ./algo-showenv.sh \
              'algo_provider "{{ algo_provider }}"' \
              {% if ipsec_enabled %}
              'algo_ondemand_cellular "{{ algo_ondemand_cellular }}"' \
              'algo_ondemand_wifi "{{ algo_ondemand_wifi }}"' \
              'algo_ondemand_wifi_exclude "{{ algo_ondemand_wifi_exclude }}"' \
              {% endif %}
              'algo_dns_adblocking "{{ algo_dns_adblocking }}"' \
              'algo_ssh_tunneling "{{ algo_ssh_tunneling }}"' \
              'wireguard_enabled "{{ wireguard_enabled }}"' \
              'dns_encryption "{{ dns_encryption }}"' \
              > /dev/tty || true
      tags: debug

    # Install cloud provider specific dependencies
    - name: Install cloud provider dependencies
      shell: uv pip install '.[{{ cloud_provider_extra }}]'
      vars:
        cloud_provider_extra: >-
          {%- if algo_provider in ['ec2', 'lightsail'] -%}aws
          {%- elif algo_provider == 'azure' -%}azure
          {%- elif algo_provider == 'gce' -%}gcp
          {%- elif algo_provider == 'hetzner' -%}hetzner
          {%- elif algo_provider == 'linode' -%}linode
          {%- elif algo_provider == 'openstack' -%}openstack
          {%- elif algo_provider == 'cloudstack' -%}cloudstack
          {%- else -%}{{ algo_provider }}
          {%- endif -%}
      when: algo_provider != "local"
      changed_when: false

  # Note: pyOpenSSL and segno are now included in pyproject.toml dependencies
  # and installed automatically by uv sync
  delegate_to: localhost
  become: false

- block:
    - name: Generate the SSH private key
      community.crypto.openssl_privatekey:
        path: "{{ SSH_keys.private }}"
        size: 4096
        mode: "0600"
        type: RSA

    - name: Generate the SSH public key
      community.crypto.openssl_publickey:
        path: "{{ SSH_keys.public }}"
        privatekey_path: "{{ SSH_keys.private }}"
        format: OpenSSH

    - name: Copy the private SSH key to /tmp
      copy:
        src: "{{ SSH_keys.private }}"
        dest: "{{ SSH_keys.private_tmp }}"
        force: true
        mode: "0600"
      delegate_to: localhost
      become: false
  when: algo_provider != "local"
