---
- name: Setup secret name
  ansible.builtin.set_fact:
    vm_name_secret: "{{ proxmox_secrets_prefix }}_{{ vm_name | replace('-','_') }}"

- name: Check if variable is in vault
  ansible.builtin.set_fact:
    variable_exists: "{{ vm_name_secret in vault_data }}"

- name: Set new secret
  ansible.builtin.set_fact:
    cipassword: "{{ lookup('password', '/dev/null length=32 chars=ascii_letters,digits') }}"
  when: not variable_exists

- name: Set new secret
  ansible.builtin.set_fact:
    new_vault_data: "{{ vault_data | combine({ vm_name_secret: cipassword }) }}"
  when: not variable_exists

- name: Write updated Vault content to file (temporary plaintext)
  ansible.builtin.copy:
    content: "{{ new_vault_data | to_nice_yaml }}"
    dest: "{{ proxmox_vault_file }}"
    mode: "0600"
  when: not variable_exists
  no_log: true