---
# nocheck: run-once

# -----------------------------
# Mode: letsencrypt
# -----------------------------
- name: "✅ TLS | (letsencrypt) ensure certs and set paths"
  ansible.builtin.include_role:
    name: sys-front-tls-letsencrypt
  when: tls_mode_effective == 'letsencrypt'

- name: "✅ TLS | (self_signed) ensure certs and set paths"
  ansible.builtin.include_role:
    name: sys-front-tls-selfsigned
  when: tls_mode_effective == 'self_signed'

- name: "📂 Load http redirect routines"
  include_tasks: 01_http.yml
  when: lookup('tls', application_id, 'enabled') | bool