- block:
  - name: base | system setup | make sure directory exists
    file:
      path: "/etc/ca-certificates/trust-source/anchors"
      state: directory

  - name: base | system setup | get step-ca certificate
    get_url:
      url: "https://step-ca.universe.local/roots.pem"
      dest: "/usr/local/share/ca-certificates/step-ca.crt"
      validate_certs: false

  - name: base | system setup | import step-ca certificate
    command:
      cmd: "{{ update_ca }}"
  become: yes
  rescue:
    - set_fact: task_failed=true