---
- name: Install packages
  apt: pkg={{ item }} state=present
  with_items:
    - openssl
    - ssl-cert
- name: Make sure {{ path }} exists
  file: path='{{ path }}' state=directory owner=root group=ssl-cert mode=0710
- name: Make sure domain directories exist
  file: path='{{ path }}/{{ item }}' state=directory owner=root group=ssl-cert mode=0710
  with_items: '{{ selfsigned }}'
- name: Generate private keys
  command: >
    openssl genrsa
    -out '{{ path }}/{{ item }}/clean.key'
    2048
  args:
    creates: '{{ path }}/{{ item }}/clean.key'
  with_items: '{{ selfsigned }}'
- name: Set permissions for private keys
  file: path='{{ path }}/{{ item }}/clean.key' state=file owner=root group=ssl-cert mode=0640
  with_items: '{{ selfsigned }}'
- name: Generate self-signed certificates
  command: >
    openssl req
    -new
    -x509
    -subj '/CN={{ item }}'
    -extensions v3_ca
    -days 3650
    -key '{{ path }}/{{ item }}/clean.key'
    -out '{{ path }}/{{ item }}/selfsigned.pem'
  args:
    creates: '{{ path }}/{{ item }}/selfsigned.pem'
  with_items: '{{ selfsigned }}'
- name: Set permissions for self-signed certificates
  file: path='{{ path }}/{{ item }}/selfsigned.pem' state=file owner=root group=ssl-cert mode=0640
  with_items: '{{ selfsigned }}'
...