---
- name: "Ensure gateway packages are installed"
  become: true
  ansible.builtin.package:
    name:
      - "iptables"
      - "iproute2"
      - "udev"
    state: "present"

- name: "Configure IP forwarding"
  become: true
  ansible.builtin.template:
    src: "99-gateway.conf.j2"
    dest: "/etc/sysctl.d/99-gateway.conf"
    owner: "root"
    group: "root"
    mode: "0644"
  notify: "Reload sysctl"

- name: "Deploy gateway apply rules script"
  become: true
  ansible.builtin.template:
    src: "gateway-apply-rules.sh.j2"
    dest: "/usr/local/bin/gateway-apply-rules"
    mode: "0755"
    owner: "root"
    group: "root"

- name: "Deploy udev rules for WireGuard interface events"
  become: true
  ansible.builtin.template:
    src: "99-wireguard-gateway.rules.j2"
    dest: "/etc/udev/rules.d/99-wireguard-gateway.rules"
    mode: "0644"
    owner: "root"
    group: "root"
  notify: "Reload udev"

- name: "Deploy gateway VPN mode systemd service"
  become: true
  ansible.builtin.template:
    src: "gateway-vpn-mode.service.j2"
    dest: "/etc/systemd/system/gateway-vpn-mode.service"
    mode: "0644"
  notify: "Reload systemd"

- name: "Deploy gateway direct mode systemd service"
  become: true
  ansible.builtin.template:
    src: "gateway-direct-mode.service.j2"
    dest: "/etc/systemd/system/gateway-direct-mode.service"
    mode: "0644"
  notify: "Reload systemd"

- name: "Deploy gateway init systemd service"
  become: true
  ansible.builtin.template:
    src: "gateway-init.service.j2"
    dest: "/etc/systemd/system/gateway-init.service"
    mode: "0644"
  notify: "Reload systemd"

- name: "Enable gateway init service"
  become: true
  ansible.builtin.systemd_service:
    name: "gateway-init.service"
    enabled: "{{ gateway_enabled }}"
    daemon_reload: true