---
- name: "Ensure gateway packages are installed"
  become: true
  ansible.builtin.package:
    name:
      - "iptables"
      - "iproute2"
      - "udev"
      - "radvd"
    state: "present"

- name: "Configure IP forwarding"
  become: true
  ansible.builtin.template:
    src: "99-gateway.conf.j2"
    dest: "/etc/sysctl.d/99-gateway.conf"
    owner: "root"
    group: "root"
    mode: "0644"
  notify: "Reload sysctl"

- name: "Deploy gateway apply rules script"
  become: true
  ansible.builtin.template:
    src: "gateway-apply-rules.sh.j2"
    dest: "/usr/local/bin/gateway-apply-rules"
    mode: "0755"
    owner: "root"
    group: "root"

- name: "Deploy udev rules for WireGuard interface events"
  become: true
  ansible.builtin.template:
    src: "99-wireguard-gateway.rules.j2"
    dest: "/etc/udev/rules.d/99-wireguard-gateway.rules"
    mode: "0644"
    owner: "root"
    group: "root"
  notify: "Reload udev"

- name: "Deploy gateway VPN mode systemd service"
  become: true
  ansible.builtin.template:
    src: "gateway-vpn-mode.service.j2"
    dest: "/etc/systemd/system/gateway-vpn-mode.service"
    mode: "0644"
  notify: "Reload systemd"

- name: "Deploy gateway direct mode systemd service"
  become: true
  ansible.builtin.template:
    src: "gateway-direct-mode.service.j2"
    dest: "/etc/systemd/system/gateway-direct-mode.service"
    mode: "0644"
  notify: "Reload systemd"

- name: "Deploy gateway init systemd service"
  become: true
  ansible.builtin.template:
    src: "gateway-init.service.j2"
    dest: "/etc/systemd/system/gateway-init.service"
    mode: "0644"
  notify: "Reload systemd"

- name: "Enable gateway init service"
  become: true
  ansible.builtin.systemd_service:
    name: "gateway-init.service"
    enabled: "{{ gateway_enabled }}"
    daemon_reload: true

- name: "Configure radvd for IPv6 RA"
  become: true
  when: gateway_enabled and gateway_local_ipv6_subnet != ""
  block:
    - name: "Deploy radvd config"
      ansible.builtin.template:
        src: "radvd.conf.j2"
        dest: "/etc/radvd.conf"
        owner: "root"
        group: "root"
        mode: "0644"
      notify: "Restart radvd"

    - name: "Enable radvd service"
      ansible.builtin.systemd_service:
        name: "radvd.service"
        enabled: true
        state: "started"
        daemon_reload: true

- name: "Disable radvd when no IPv6 subnet configured"
  become: true
  when: not gateway_enabled or gateway_local_ipv6_subnet == ""
  block:
    - name: "Stop and disable radvd"
      ansible.builtin.systemd_service:
        name: "radvd.service"
        enabled: false
        state: "stopped"
      failed_when: false

    - name: "Remove radvd config"
      ansible.builtin.file:
        path: "/etc/radvd.conf"
        state: "absent"