main.yml

---
- name: "🔐 Set up CA trust for '{{ application_id }}' once per play"
  when: run_once_sys_svc_compose_ca is not defined
  block:
    - name: "🚫 CA trust N/A for '{{ application_id }}' (TLS off/not self-signed) — mark done"
      ansible.builtin.debug:
        msg: >-
          Skipping CA trust assets for '{{ application_id }}': no domain, TLS
          disabled (e.g. onion), or mode is not self_signed.
      when: not (_compose_ca_applicable | bool)

    - include_tasks: 00_core.yml
      when: _compose_ca_applicable | bool