- name: Check if all nodes are in STANDALONE state
  cisco.ise.personas_check_standalone:
    ip: "{{ item.ip }}"
    username: "{{ personas_deployment_ise_username }}"
    password: "{{ personas_deployment_ise_password }}"
    hostname: "{{ item.hostname }}"
  loop:
    # ISE PAN Server 1
    # - ip: "{{ pan1_ip }}"
    #   hostname: "{{ personas_deployment_ise_base_hostname | lower }}-pan-server-1"
    # ISE PAN Server 2
    - ip: "{{ personas_deployment_pan2_ip }}"
      hostname: "{{ personas_deployment_ise_base_hostname | lower }}-pan-server-2"
    # ISE PSN Server 1
    - ip: "{{ personas_deployment_psn1_ip }}"
      hostname: "{{ personas_deployment_ise_base_hostname | lower }}-psn-server-1"
    # ISE PSN Server 2
    - ip: "{{ personas_deployment_psn2_ip }}"
      hostname: "{{ personas_deployment_ise_base_hostname | lower }}-psn-server-2"

- name: Export trusted certificates into primary node
  cisco.ise.personas_export_certs:
    primary_ip: "{{ personas_deployment_pan1_ip }}"
    primary_username: "{{ personas_deployment_ise_username }}"
    primary_password: "{{ personas_deployment_ise_password }}"
    name: "{{ item.name }}"
    ip: "{{ item.ip }}"
    hostname: "{{ item.hostname }}"
    username: "{{ personas_deployment_ise_username }}"
    password: "{{ personas_deployment_ise_password }}"
  loop:
    - name: ISE PAN Server 2
      ip: "{{ personas_deployment_pan2_ip }}"
      hostname: "{{ personas_deployment_ise_base_hostname | lower }}-pan-server-2"
    - name: ISE PSN Server 1
      ip: "{{ personas_deployment_psn1_ip }}"
      hostname: "{{ personas_deployment_ise_base_hostname | lower }}-psn-server-1"
    - name: ISE PSN Server 2
      ip: "{{ personas_deployment_psn2_ip }}"
      hostname: "{{ personas_deployment_ise_base_hostname | lower }}-psn-server-2"

- name: Promote primary node
  cisco.ise.personas_promote_primary:
    ip: "{{ personas_deployment_pan1_ip }}"
    username: "{{ personas_deployment_ise_username }}"
    password: "{{ personas_deployment_ise_password }}"

- name: Register the nodes to the cluster
  cisco.ise.personas_register_node:
    primary_ip: "{{ personas_deployment_pan1_ip }}"
    primary_username: "{{ personas_deployment_ise_username }}"
    primary_password: "{{ personas_deployment_ise_password }}"
    fqdn: "{{ item.fqdn }}"
    username: "{{ personas_deployment_ise_username }}"
    password: "{{ personas_deployment_ise_password }}"
    roles: "{{ item.roles }}"
    services: "{{ item.services }}"
  loop:
    # ISE PAN Server 2
    - fqdn: "{{ personas_deployment_ise_base_hostname | lower }}-pan-server-2.{{ personas_deployment_ise_domain }}"
      roles:
        - SecondaryAdmin
        - SecondaryMonitoring
      services: []
    # ISE PSN Server 1
    - fqdn: "{{ personas_deployment_ise_base_hostname | lower }}-psn-server-1.{{ personas_deployment_ise_domain }}"
      roles: []
      services:
        - Session
        - Profiler
    # ISE PSN Server 2
    - fqdn: "{{ personas_deployment_ise_base_hostname | lower }}-psn-server-2.{{ personas_deployment_ise_domain }}"
      roles: []
      services:
        - Session
        - Profiler

- name: Remove the Session and Profiler services from the primary node
  cisco.ise.personas_update_roles_services:
    ip: "{{ personas_deployment_pan1_ip }}"
    username: "{{ personas_deployment_ise_username }}"
    password: "{{ personas_deployment_ise_password }}"
    hostname: "{{ personas_deployment_ise_base_hostname | lower }}-pan-server-1"
    roles:
      - PrimaryAdmin
      - PrimaryMonitoring
    services: []
