[Interface]
Address = {{ wireguard_address }}
PrivateKey = {{ wireguard_private_key }}
{% if wireguard_role == 'server' %}
ListenPort = {{ wireguard_listen_port }}
{% for route in wireguard_home_routes %}
PostUp = ip route replace {{ route }} dev {{ wireguard_interface }}
PostDown = ip route del {{ route }} dev {{ wireguard_interface }} || true
{% endfor %}
{% endif %}
{% if wireguard_role == 'gateway' %}
PostUp = iptables -t nat -A POSTROUTING -s {{ wireguard_network_cidr }} -d {{ homelab_lan_cidr }} -o eth0 -j MASQUERADE
PostDown = iptables -t nat -D POSTROUTING -s {{ wireguard_network_cidr }} -d {{ homelab_lan_cidr }} -o eth0 -j MASQUERADE || true
{% endif %}

[Peer]
{% if wireguard_role == 'server' %}
PublicKey = {{ hostvars['wg-mini'].wireguard_public_key }}
AllowedIPs = {{ wireguard_peer_address }}/32, {{ wireguard_home_routes | join(', ') }}
{% endif %}
{% if wireguard_role == 'gateway' %}
PublicKey = {{ hostvars['ru-vps'].wireguard_public_key }}
Endpoint = 157.22.231.198:{{ wireguard_listen_port }}
AllowedIPs = {{ wireguard_peer_address }}/32
PersistentKeepalive = 25
{% endif %}