---
- name: "Ensure iptables and iproute2 are installed"
  become: true
  ansible.builtin.package:
    name:
      - "iptables"
      - "iproute2"
      - "udev"
    state: "present"

- name: "Configure IP forwarding"
  become: true
  ansible.builtin.blockinfile:
    path: "/etc/sysctl.conf"
    state: "{{ 'present' if gateway_enabled else 'absent' }}"
    prepend_newline: true
    append_newline: true
    marker: "# ==== {mark} ANSIBLE GATEWAY CONFIG"
    create: true
    mode: "0644"
    block: |
      net.ipv4.ip_forward=1
      net.ipv6.conf.all.forwarding=1
  notify: "Reload sysctl"

- name: "Deploy gateway apply rules script"
  become: true
  ansible.builtin.template:
    src: "gateway-apply-rules.sh.j2"
    dest: "/usr/local/bin/gateway-apply-rules"
    mode: "0755"
    owner: "root"
    group: "root"

- name: "Deploy udev rules for WireGuard interface events"
  become: true
  ansible.builtin.template:
    src: "99-wireguard-gateway.rules.j2"
    dest: "/etc/udev/rules.d/99-wireguard-gateway.rules"
    mode: "0644"
    owner: "root"
    group: "root"
  notify: "Reload udev"

- name: "Deploy gateway VPN mode systemd service"
  become: true
  ansible.builtin.template:
    src: "gateway-vpn-mode.service.j2"
    dest: "/etc/systemd/system/gateway-vpn-mode.service"
    mode: "0644"
  notify: "Reload systemd"

- name: "Deploy gateway direct mode systemd service"
  become: true
  ansible.builtin.template:
    src: "gateway-direct-mode.service.j2"
    dest: "/etc/systemd/system/gateway-direct-mode.service"
    mode: "0644"
  notify: "Reload systemd"

- name: "Deploy gateway init systemd service"
  become: true
  ansible.builtin.template:
    src: "gateway-init.service.j2"
    dest: "/etc/systemd/system/gateway-init.service"
    mode: "0644"
  notify: "Reload systemd"

- name: "Enable gateway init service"
  become: true
  ansible.builtin.systemd_service:
    name: "gateway-init.service"
    enabled: "{{ gateway_enabled }}"
    daemon_reload: true