---
- name: "Create wg-portal group"
  become: true
  ansible.builtin.group:
    name: "wg-portal"
    system: true

- name: "Create wg-portal user"
  become: true
  ansible.builtin.user:
    name: "wg-portal"
    group: "wg-portal"
    system: true
    shell: "/usr/sbin/nologin"
    create_home: false

- name: "Check if wg-portal is already installed"
  become: true
  ansible.builtin.stat:
    path: "/etc/wg-portal/wg-portal"
  register: wg_portal_binary_check

- name: "Create wg-portal directories"
  become: true
  ansible.builtin.file:
    path: "/etc/wg-portal"
    state: "directory"
    owner: "root"
    group: "wg-portal"
    mode: "0750"

- name: "Install wg-portal"
  become: true
  when: not wg_portal_binary_check.stat.exists
  block:
    - name: "Download wg-portal installer"
      ansible.builtin.get_url:
        url: "https://git.sr.ht/~a14m/wg-portal/blob/main/deployment/install.sh"
        dest: "/tmp/install_wg-portal.sh"
        mode: "0755"

    - name: "Run wg-portal installer"
      ansible.builtin.command:
        cmd: "/tmp/install_wg-portal.sh {{ wg_portal_version }}"
      args:
        creates: "/etc/wg-portal/wg-portal"

- name: "Set ACL for wg-portal group on /etc/wireguard"
  become: true
  ansible.posix.acl:
    path: "/etc/wireguard"
    entity: "wg-portal"
    etype: "group"
    permissions: "rx"
    recursive: true
    default: true
    state: "present"

- name: "Set ACL mask for /etc/wireguard"
  become: true
  ansible.posix.acl:
    path: "/etc/wireguard"
    etype: "mask"
    permissions: "rx"
    recursive: true
    default: true
    state: "present"

- name: "Create wg-portal sudoers file"
  become: true
  ansible.builtin.copy:
    content: |
      %wg-portal ALL=(ALL) NOPASSWD: /usr/bin/wg-quick up *, /usr/bin/wg-quick down *
      %wg-portal ALL=(ALL) NOPASSWD: /usr/bin/wg show
    dest: "/etc/sudoers.d/wg-portal"
    mode: "0440"
    validate: "visudo -cf %s"

- name: "Create wg-portal configuration file"
  become: true
  ansible.builtin.template:
    src: "config.yml.j2"
    dest: "/etc/wg-portal/config.yml"
    owner: "root"
    group: "wg-portal"
    mode: "0640"
  notify: "Restart wg-portal"
  no_log: true

- name: "Start and enable wg-portal"
  become: true
  ansible.builtin.systemd_service:
    name: "wg-portal"
    state: "started"
    enabled: true

- name: "Create wg-portal nginx vhost configuration"
  become: true
  when: proxy_type == "nginx" and wg_portal_hostname | length > 0
  ansible.builtin.template:
    src: "wg_portal.nginx.conf.j2"
    dest: "/etc/nginx/conf.d/wg-portal.conf"
    owner: "root"
    group: "root"
    mode: "0644"
    backup: true
    validate: >
      bash -c 'echo "events { worker_connections 64; } http { include %s; }" > /tmp/nginx-vhost.conf;
        sudo nginx -T -c /tmp/nginx-vhost.conf; ec=$?; rm -f /tmp/nginx-vhost.conf; exit $ec'
  notify: "Restart proxy"

- name: "Create wg-portal caddy configuration"
  become: true
  when: proxy_type == "caddy" and wg_portal_hostname | length > 0
  ansible.builtin.template:
    src: "wg_portal.caddy.j2"
    dest: "/etc/caddy/sites/wg-portal.caddy"
    owner: "root"
    group: "caddy"
    mode: "0640"
  notify: "Restart proxy"