- hosts: servers
  roles:
    - role: cosandr.pg_cert_store
      vars:
        pg_cert_pull:
          # All details
          - name: "example.com"
            cert_path: "/etc/nginx/example.crt"
            key_path: "/etc/nginx/example.key"
            chain_path: "/etc/nginx/example.chain.crt"
            owner: root
            group: nginx
            public_mode: "0644"
            private_mode: "0640"
            chain_mode: "0644"
          # If cert_path or key_path are not specified
          # cert is placed at "{{ pg_cert_default_cert_path }}/{{ c.name }}.crt"
          # key is placed at "{{ pg_cert_default_key_path }}/{{ c.name }}.key"
          - name: "another.example.com"

        pg_cert_pull_hooks:
          - name: restart-nginx
            content: |
              #!/bin/sh

              systemctl restart nginx

          - name: only-once
            disabled: "{{ inventory_hostname != groups['example'][0] }}"
            content: |
              #!/bin/sh

              echo "I will only run on one host"