---
- name: "Include OS-specific variables"
  ansible.builtin.include_vars: "{{ ansible_facts['os_family'] | lower }}.yml"

- name: "Ensure wireguard is installed"
  become: true
  ansible.builtin.package:
    name: "{{ wireguard_packages }}"
    state: "present"

- name: "Find existing WireGuard connections"
  become: true
  ansible.builtin.shell: |
    set -euo pipefail
    ls /etc/wireguard/wg-*.conf | xargs -n1 basename | sed 's/^wg-//;s/\.conf$//'
  args:
    executable: /bin/bash
  register: wireguard_existing_connections
  changed_when: false
  failed_when: false

- name: "Remove extra WireGuard connections"
  become: true
  ansible.builtin.file:
    path: "/etc/wireguard/wg-{{ item }}.conf"
    state: "absent"
  loop: "{{ wireguard_existing_connections.stdout_lines }}"
  when:
    - wireguard_existing_connections.stdout_lines is defined
    - wireguard_existing_connections.stdout_lines | length > 0
    - item not in wireguard_connections.keys()

- name: "Deploy WireGuard connections"
  become: true
  ansible.builtin.copy:
    content: "{{ wireguard_connections[item] }}"
    dest: "/etc/wireguard/wg-{{ item }}.conf"
    owner: "root"
    group: "root"
    mode: "0600"
  loop: "{{ wireguard_connections.keys() }}"
  when: wireguard_connections | length > 0
  tags:
    # The reason the test is ignored is the following:
    # 1st run: wireguard role deploys all the configured VPN connections
    # 1st run: wg_portal updates the (ACL) file permissions /etc/wireguard
    # 2nd run: wireguard sees the file changed, deploys again (changed)
    - molecule-idempotence-notest

- name: "Ensure all wireguard interfaces are disabled on startup"
  become: true
  ansible.builtin.systemd_service:
    name: "wg-quick@wg-{{ item }}"
    enabled: false
    state: "stopped"
  when: wireguard_autostart_connection == ""
  loop: "{{ wireguard_connections.keys() | list }}"

- name: "Configure autostart connection"
  become: true
  when: wireguard_autostart_connection != ""
  block:
    - name: "Validate wireguard_autostart_connection"
      ansible.builtin.assert:
        that:
          - wireguard_autostart_connection in wireguard_connections.keys()
        fail_msg: "wireguard_autostart_connection '{{ wireguard_autostart_connection }}'
          is not defined in wireguard_connections"

    - name: "Ensure all wireguard interfaces are down"
      ansible.builtin.command:
        cmd: "wg-quick down wg-{{ item }}"
      loop: "{{ wireguard_connections.keys() | list }}"
      changed_when: false
      failed_when: false

    - name: "Enable and start wg-quick service for connection {{ wireguard_autostart_connection }}"
      ansible.builtin.systemd_service:
        name: "wg-quick@wg-{{ wireguard_autostart_connection }}"
        enabled: true
        state: "started"