---
# После переезда на OpenTofu (tofu/svc-ovpn-mini.tf, VMID 160) обе play здесь —
# legacy: они таргетят СТАРЫЙ VMID 132, а их handlers сделали бы pct start 132,
# подняв остановленный откат на боевом адресе 192.168.1.23. Пропускаем, пока
# реестр говорит provisioner: tofu. Конфигурация OpenVPN-шлюза в этот плейбук
# никогда не входила — она в playbooks/openvpn-vps-mini.yml (роль
# openvpn_gateway, группа vpn_openvpn). Для намеренного legacy rollback:
#   -e pve_ovpn_mini_legacy_provisioning_enabled=true

- name: Create ovpn-mini LXC on mini-pc
  hosts: localhost
  connection: local
  gather_facts: false
  vars:
    pve_ovpn_mini_legacy_provisioning_enabled: >-
      {{ homelab_services['ovpn-mini'].provisioner != 'tofu' }}
  pre_tasks:
    - name: Skip legacy ovpn-mini provisioning after cutover
      ansible.builtin.meta: end_play
      when: not (pve_ovpn_mini_legacy_provisioning_enabled | bool)
  roles:
    - role: pve_lxc
      vars:
        pve_lxc_vmid: 132
        pve_lxc_node: mini-pc
        pve_lxc_hostname: ovpn-mini
        pve_lxc_ip: 192.168.1.23/24
        pve_lxc_gateway: 192.168.1.1
        pve_lxc_storage: local-lvm
        pve_lxc_disk: local-lvm:8
        pve_lxc_ostemplate: "{{ lookup('env', 'PVE_LXC_OSTEMPLATE') | default('local:vztmpl/debian-13-standard_13.1-2_amd64.tar.zst', true) }}"

- name: Allow TUN device in ovpn-mini LXC config
  hosts: mini-pc
  gather_facts: false
  become: true
  vars:
    pve_ovpn_mini_legacy_provisioning_enabled: >-
      {{ homelab_services['ovpn-mini'].provisioner != 'tofu' }}
  handlers:
    - name: restart ovpn-mini lxc
      ansible.builtin.shell: pct stop 132 || true; pct start 132
      changed_when: true
  pre_tasks:
    - name: Skip legacy ovpn-mini provisioning after cutover
      ansible.builtin.meta: end_play
      when: not (pve_ovpn_mini_legacy_provisioning_enabled | bool)
  tasks:
    - name: Allow /dev/net/tun device
      ansible.builtin.lineinfile:
        path: /etc/pve/lxc/132.conf
        line: "lxc.cgroup2.devices.allow: c 10:200 rwm"
        state: present
      notify: restart ovpn-mini lxc

    - name: Bind mount /dev/net/tun
      ansible.builtin.lineinfile:
        path: /etc/pve/lxc/132.conf
        line: "lxc.mount.entry: /dev/net/tun dev/net/tun none bind,create=file"
        state: present
      notify: restart ovpn-mini lxc