---
- name: "Include OS-specific variables"
  ansible.builtin.include_vars: "{{ ansible_facts['distribution'] | lower }}.yml"

- name: "Include OS-specific tasks"
  ansible.builtin.include_tasks: "install-{{ ansible_facts['os_family'] | lower }}.yml"

- name: "Validate network_ipv4_* params"
  ansible.builtin.assert:
    that:
      - network_ipv4_address is defined
      - network_ipv4_gateway is defined
    fail_msg: "network_ipv4_address and network_ipv4_gateway are required together"
  when: network_ipv4_address is defined or network_ipv4_gateway is defined

- name: "Ensure network enabled services are enabled"
  become: true
  ansible.builtin.systemd_service:
    name: "{{ item }}"
    enabled: true
    state: "started"
  loop: "{{ network_enabled_services }}"
  when: not ansible_facts['is_chroot']

- name: "(chroot): Ensure network enabled services are enabled"
  ansible.builtin.command:
    cmd: "systemctl enable {{ item }}"
  changed_when: true
  loop: "{{ network_enabled_services }}"
  when: ansible_facts['is_chroot']
  # noqa: command-instead-of-module module doesn't work inside chroot

- name: "Ensure network disabled services are masked"
  become: true
  ansible.builtin.systemd_service:
    name: "{{ item }}"
    masked: true
    state: "stopped"
  loop: "{{ network_disabled_services }}"
  when: not ansible_facts['is_chroot']

- name: "(chroot): Ensure network disabled services are masked"
  ansible.builtin.command:
    cmd: "systemctl mask {{ item }}"
  changed_when: true
  loop: "{{ network_disabled_services }}"
  when: ansible_facts['is_chroot']
  # noqa: command-instead-of-module module doesn't work inside chroot

- name: "Compute hex-encoded SSID for iwd filename"
  # noqa: risky-shell-pipe since this is used early before bash configuration
  # it is the exception and needed to ensure that iwd is working on Mac machines
  # that only work with broadcom-wl and iwd
  # od is part of coreutils which is available by default on Arch/Debian but
  # added as role dependency for safty
  ansible.builtin.shell:
    cmd: "printf '%s' '{{ network_wifi_ssid }}' | od -A n -t x1 | tr -d ' \\n'"
  register: network_wifi_hex_ssid
  changed_when: false
  when: network_wifi_ssid != ""

- name: "Configure address family preference"
  become: true
  ansible.builtin.template:
    src: "gai.conf.j2"
    dest: "/etc/gai.conf"
    owner: "root"
    group: "root"
    mode: "0644"

- name: "Configure NetworkManager"
  become: true
  notify:
    - "Reload systemd"
    - "Restart NetworkManager"
    - "Restart systemd-resolved"
  block:
    - name: "Ensure /etc/systemd/resolved.conf.d exists"
      ansible.builtin.file:
        path: "/etc/systemd/resolved.conf.d"
        state: directory
        mode: "0755"

    - name: "Configure systemd-resolved"
      ansible.builtin.template:
        src: "resolved.conf.j2"
        # NOTE: drop-in needed to override vendor drop-ins (e.g. Ubuntu 26.04 ships
        # /usr/lib/systemd/resolved.conf.d/ with MulticastDNS=no) which take precedence
        # over /etc/systemd/resolved.conf
        dest: "/etc/systemd/resolved.conf.d/99-custom.conf"
        mode: "0644"

    - name: "Configure NetworkManager"
      ansible.builtin.template:
        src: "NetworkManager.conf.j2"
        dest: "/etc/NetworkManager/NetworkManager.conf"
        mode: "0644"

    - name: "Configure ethernet connection"
      ansible.builtin.template:
        src: "eth0-connection.nmconnection.j2"
        dest: "/etc/NetworkManager/system-connections/ethernet.nmconnection"
        mode: "0600"
        owner: "root"
        group: "root"

    - name: "Configure bridge connection"
      ansible.builtin.template:
        src: "bridge.nmconnection.j2"
        dest: "/etc/NetworkManager/system-connections/vmbr0.nmconnection"
        mode: "0600"
        owner: "root"
        group: "root"
      when: network_bridge_interface is defined

    - name: "Configure wifi connection"
      ansible.builtin.template:
        src: "wifi-connection.nmconnection.j2"
        dest: "/etc/NetworkManager/system-connections/{{ network_wifi_ssid }}.nmconnection"
        mode: "0600"
        owner: "root"
        group: "root"
      when: network_wifi_ssid != ""

    - name: "Ensure /var/lib/iwd directory exists"
      ansible.builtin.file:
        path: "/var/lib/iwd"
        state: "directory"
        mode: "0700"
        owner: "root"
        group: "root"
      when: network_wifi_ssid != ""

    - name: "Configure iwd known network for wifi auto-connect"
      community.general.ini_file:
        path: "/var/lib/iwd/={{ network_wifi_hex_ssid.stdout }}.psk"
        section: "Security"
        option: "Passphrase"
        value: "{{ network_wifi_pass }}"
        mode: "0600"
      when: network_wifi_ssid != ""