---
- name: Install WireGuard packages
  ansible.builtin.apt:
    name:
      - wireguard-tools
      - iptables
      - iproute2
      - netcat-openbsd
    state: present
    update_cache: true

- name: Ensure WireGuard config directory exists
  ansible.builtin.file:
    path: /etc/wireguard
    state: directory
    owner: root
    group: root
    mode: "0700"

- name: Generate private key if missing
  ansible.builtin.shell: umask 077 && wg genkey > {{ wireguard_private_key_path }}
  args:
    creates: "{{ wireguard_private_key_path }}"

- name: Generate public key
  ansible.builtin.shell: wg pubkey < {{ wireguard_private_key_path }} > {{ wireguard_public_key_path }}
  args:
    creates: "{{ wireguard_public_key_path }}"

- name: Read private key
  ansible.builtin.slurp:
    src: "{{ wireguard_private_key_path }}"
  register: wireguard_private_key_raw
  no_log: true

- name: Read public key
  ansible.builtin.slurp:
    src: "{{ wireguard_public_key_path }}"
  register: wireguard_public_key_raw

- name: Store WireGuard keys as facts
  ansible.builtin.set_fact:
    wireguard_private_key: "{{ wireguard_private_key_raw.content | b64decode | trim }}"
    wireguard_public_key: "{{ wireguard_public_key_raw.content | b64decode | trim }}"
  no_log: true

- name: Enable IPv4 forwarding on gateway
  ansible.posix.sysctl:
    name: net.ipv4.ip_forward
    value: "1"
    state: present
    reload: true
  when: wireguard_role == 'gateway'

- name: Allow WireGuard UDP in UFW on server
  ansible.builtin.command: "ufw allow {{ wireguard_listen_port }}/udp"
  register: ufw_allow_wireguard
  changed_when: "'Rule added' in ufw_allow_wireguard.stdout or 'Rules updated' in ufw_allow_wireguard.stdout"
  failed_when: false
  when: wireguard_role == 'server'

- name: Render WireGuard config
  ansible.builtin.template:
    src: "wg0.conf.j2"
    dest: "/etc/wireguard/{{ wireguard_interface }}.conf"
    owner: root
    group: root
    mode: "0600"
  notify: restart wireguard

- name: Enable and start WireGuard
  ansible.builtin.systemd:
    name: "wg-quick@{{ wireguard_interface }}"
    state: started
    enabled: true