- name: Create wg-mini LXC on mini-pc
  hosts: localhost
  connection: local
  gather_facts: false
  roles:
    - role: pve_lxc
      vars:
        pve_lxc_vmid: 132
        pve_lxc_node: mini-pc
        pve_lxc_hostname: wg-mini
        pve_lxc_ip: 192.168.1.23/24
        pve_lxc_gateway: 192.168.1.1
        pve_lxc_storage: local-lvm
        pve_lxc_disk: local-lvm:8
        pve_lxc_ostemplate: "{{ lookup('env', 'PVE_LXC_OSTEMPLATE') | default('local:vztmpl/debian-13-standard_13.1-2_amd64.tar.zst', true) }}"

- name: Allow TUN device in wg-mini LXC config
  hosts: mini-pc
  gather_facts: false
  become: true
  handlers:
    - name: restart wg-mini lxc
      ansible.builtin.shell: pct stop 132 || true; pct start 132
      changed_when: true
  tasks:
    - name: Allow /dev/net/tun device
      ansible.builtin.lineinfile:
        path: /etc/pve/lxc/132.conf
        line: "lxc.cgroup2.devices.allow: c 10:200 rwm"
        state: present
      notify: restart wg-mini lxc

    - name: Bind mount /dev/net/tun
      ansible.builtin.lineinfile:
        path: /etc/pve/lxc/132.conf
        line: "lxc.mount.entry: /dev/net/tun dev/net/tun none bind,create=file"
        state: present
      notify: restart wg-mini lxc