also remove the admin creation drop-in

roles/keycloak/handlers/main.yml

@@ -2,3 +2,7 @@
 
 - name: restart keycloak
   service: name=keycloak state=restarted
+
+- name: daemon reload
+  systemd:
+    daemon-reload: true

roles/keycloak/tasks/main.yml

@@ -22,19 +22,17 @@
   notify:
     - restart keycloak
 
-- name: get service facts
-  service_facts:
-
 - name: create drop-in directory for keycloak.service
   file: path=/etc/systemd/system/keycloak.service.d state=directory owner=root group=root mode=0755
-  when: ansible_facts.services["keycloak.service"]["state"] != "running"
 
-- name: install drop-in for keycloak.service
-  copy: src=create-keycloak-admin.conf dest=/etc/systemd/system/keycloak.service.d/ owner=root group=root mode=0644
-  when: ansible_facts.services["keycloak.service"]["state"] != "running"
+- name: get service facts
+  service_facts:
 
 - name: create an admin user when first starting keycloak
   block:
+    - name: install admin creation drop-in for keycloak.service
+      copy: src=create-keycloak-admin.conf dest=/etc/systemd/system/keycloak.service.d/ owner=root group=root mode=0644
+
     - name: install temporary environment file with admin credentials
       template: src=admin-user.conf.j2 dest=/etc/keycloak/admin-user.conf owner=root group=root mode=0600
       no_log: true
@@ -44,6 +42,11 @@
   always:
     - name: remove admin credentials once keycloak is running
       file: path=/etc/keycloak/admin-user.conf state=absent
+
+    - name: remove admin creation drop-in
+      file: path=/etc/systemd/system/keycloak.service.d/create-keycloak-admin.conf state=absent
+      notify:
+        - daemon reload
   when: ansible_facts.services["keycloak.service"]["state"] != "running"
 
 - name: open firewall hole