---
- name: restart strongswan
  service: name={{ strongswan_service }} state=restarted

- name: daemon-reload
  systemd: daemon_reload=true

- name: restart apparmor
  service: name=apparmor state=restarted

- name: rereadcrls
  shell: |
    # Check if StrongSwan is actually running
    if ! systemctl is-active --quiet strongswan-starter 2>/dev/null && \
       ! systemctl is-active --quiet strongswan 2>/dev/null && \
       ! service strongswan status >/dev/null 2>&1; then
      echo "StrongSwan is not running, skipping CRL reload"
      exit 0
    fi

    # StrongSwan is running, wait a moment for it to stabilize
    sleep 2

    # Try to reload CRLs with retries
    for attempt in 1 2 3; do
      if ipsec rereadcrls 2>/dev/null && ipsec purgecrls 2>/dev/null; then
        echo "Successfully reloaded CRLs"
        exit 0
      fi
      echo "Attempt $attempt failed, retrying..."
      sleep 2
    done

    # If StrongSwan is running but we can't reload CRLs, that's a real problem
    echo "Failed to reload CRLs after 3 attempts"
    exit 1
  changed_when: false
