Fix StrongSwan CRL handler properly without ignoring errors

Instead of ignoring errors (anti-pattern), this fix properly handles the race
condition when StrongSwan restarts:

1. After restarting StrongSwan, wait for port 500 (IKE) to be listening
   - This ensures the daemon is fully ready before proceeding
   - Waits up to 30 seconds with proper timeout handling

2. When reloading CRLs, use Ansible's retry mechanism
   - Retries up to 3 times with 2-second delays
   - Handles transient failures during startup

3. Separated rereadcrls and purgecrls into distinct tasks
   - Better error reporting and debugging
   - Cleaner task organization

This approach ensures the installation works reliably on fresh installs
without hiding potential real errors.

🤖 Generated with [Claude Code](https://claude.ai/code)

Co-Authored-By: Claude <noreply@anthropic.com>

roles/strongswan/handlers/main.yml

@@ -1,6 +1,16 @@
 ---
 - name: restart strongswan
-  service: name={{ strongswan_service }} state=restarted
+  block:
+    - name: restart strongswan service
+      service: name={{ strongswan_service }} state=restarted
+
+    - name: wait for strongswan to be ready
+      wait_for:
+        port: 500
+        host: 127.0.0.1
+        delay: 2
+        timeout: 30
+        state: started
 
 - name: daemon-reload
   systemd: daemon_reload=true
@@ -9,14 +19,13 @@
   service: name=apparmor state=restarted
 
 - name: rereadcrls
-  shell: |
+  block:
-    # Wait for ipsec daemon to be ready (up to 10 seconds)
+    - name: reload certificate revocation lists
-    for i in $(seq 1 10); do
+      command: ipsec rereadcrls
-      if ipsec statusall >/dev/null 2>&1; then
+      register: rereadcrls_result
-        ipsec rereadcrls && ipsec purgecrls
+      retries: 3
-        exit 0
+      delay: 2
-      fi
+      until: rereadcrls_result.rc == 0
-      sleep 1
+
-    done
+    - name: purge old certificate revocation lists
-    # If daemon still not ready, try anyway but don't fail the playbook
+      command: ipsec purgecrls
-    ipsec rereadcrls; ipsec purgecrls || true