---
- name: Install OpenVPN packages
  ansible.builtin.apt:
    name:
      - openvpn
      - iptables
      - iproute2
      - netcat-openbsd
    state: present
    update_cache: true

- name: Ensure OpenVPN config directory exists
  ansible.builtin.file:
    path: "{{ openvpn_config_dir }}"
    state: directory
    owner: root
    group: root
    mode: "0700"

- name: Generate static key on server if missing
  ansible.builtin.command: "openvpn --genkey secret {{ openvpn_static_key_path }}"
  args:
    creates: "{{ openvpn_static_key_path }}"
  when: openvpn_role == 'server'
  no_log: true

- name: Read static key from server
  ansible.builtin.slurp:
    src: "{{ openvpn_static_key_path }}"
  register: openvpn_static_key_raw
  when: openvpn_role == 'server'
  no_log: true

- name: Copy static key to all peers
  ansible.builtin.copy:
    dest: "{{ openvpn_static_key_path }}"
    content: "{{ hostvars['ru-vps'].openvpn_static_key_raw.content | b64decode }}"
    owner: root
    group: root
    mode: "0600"
  no_log: true
  notify: restart openvpn

- name: Enable IPv4 forwarding on gateway
  ansible.posix.sysctl:
    name: net.ipv4.ip_forward
    value: "1"
    state: present
    reload: true
  when: openvpn_role == 'gateway'

- name: Allow OpenVPN TCP in UFW on server
  ansible.builtin.command: "ufw allow {{ openvpn_listen_port }}/tcp"
  register: ufw_allow_openvpn
  changed_when: "'Rule added' in ufw_allow_openvpn.stdout or 'Rules updated' in ufw_allow_openvpn.stdout"
  failed_when: false
  when: openvpn_role == 'server'

- name: Render OpenVPN config
  ansible.builtin.template:
    src: homelab.conf.j2
    dest: "{{ openvpn_config_path }}"
    owner: root
    group: root
    mode: "0600"
  notify: restart openvpn

- name: Render OpenVPN gateway up script
  ansible.builtin.template:
    src: up.sh.j2
    dest: "{{ openvpn_config_dir }}/up.sh"
    owner: root
    group: root
    mode: "0700"
  notify: restart openvpn
  when: openvpn_role == 'gateway'

- name: Render OpenVPN gateway down script
  ansible.builtin.template:
    src: down.sh.j2
    dest: "{{ openvpn_config_dir }}/down.sh"
    owner: root
    group: root
    mode: "0700"
  notify: restart openvpn
  when: openvpn_role == 'gateway'

- name: Render OpenVPN systemd service
  ansible.builtin.template:
    src: homelab-openvpn.service.j2
    dest: "/etc/systemd/system/{{ openvpn_service_name }}.service"
    owner: root
    group: root
    mode: "0644"
  notify: restart openvpn

- name: Reload systemd
  ansible.builtin.systemd:
    daemon_reload: true

- name: Enable and start OpenVPN
  ansible.builtin.systemd:
    name: "{{ openvpn_service_name }}"
    state: started
    enabled: true