- name: Remove WireGuard from ru-vps and wg-mini
  hosts: wireguard
  gather_facts: false
  become: true
  vars:
    wireguard_interface: wg0
    wireguard_listen_port: 3422
    wireguard_home_routes:
      - 192.168.1.5/32
      - 192.168.1.6/31
      - 192.168.1.8/29
      - 192.168.1.16/28
      - 192.168.1.32/29
      - 192.168.1.40/32
  tasks:
    - name: Stop WireGuard service
      ansible.builtin.systemd:
        name: "wg-quick@{{ wireguard_interface }}"
        state: stopped
        enabled: false
      failed_when: false

    - name: Remove WireGuard route entries on server
      ansible.builtin.command: "ip route del {{ item }} dev {{ wireguard_interface }}"
      loop: "{{ wireguard_home_routes }}"
      changed_when: false
      failed_when: false
      when: inventory_hostname == 'ru-vps'

    - name: Remove WireGuard NAT rule on gateway
      ansible.builtin.command: "iptables -t nat -D POSTROUTING -s 10.77.0.0/30 -d {{ homelab_lan_cidr }} -o eth0 -j MASQUERADE"
      changed_when: false
      failed_when: false
      when: inventory_hostname == 'wg-mini'

    - name: Remove WireGuard config directory
      ansible.builtin.file:
        path: /etc/wireguard
        state: absent

    - name: Remove WireGuard package
      ansible.builtin.apt:
        name: wireguard-tools
        state: absent
        purge: true

    - name: Remove diagnostic tcpdump from gateway
      ansible.builtin.apt:
        name: tcpdump
        state: absent
        purge: true
      when: inventory_hostname == 'wg-mini'

    - name: Delete UFW WireGuard UDP rules on server
      ansible.builtin.command: "ufw delete allow {{ item }}/udp"
      loop:
        - 3422
        - 51820
      changed_when: false
      failed_when: false
      when: inventory_hostname == 'ru-vps'