Encapsulated SAN in block with when

roles/srv-web-6-6-tls-core/tasks/flavors/san.yml

@@ -1,11 +1,11 @@
-- name: Install certbundle
+- block:
+    - name: Install certbundle
       include_role:
         name: pkgmgr-install
       vars:
         package_name: certbundle
-  when: run_once_san_certs is not defined
 
-- name: Generate SAN certificate with certbundle
+    - name: Generate SAN certificate with certbundle
       command: >-
         certbundle
         --domains "{{ current_play_domains_all | join(',') }}"
@@ -24,9 +24,8 @@
       failed_when: >
         certbundle_result.rc != 0
         and 'too many certificates' not in certbundle_result.stderr
-  when: run_once_san_certs is not defined
 
-- name: run the san tasks once
+    - name: run the san tasks once
       set_fact:
         run_once_san_certs: true
   when: run_once_san_certs is not defined