# Note that Wireguard does DNS resolution only once during connection.
# When a client's IP changes, the server should be notified in some way,
# using `wg set wg0 peer izHzmRwh2yzICps6pFI2Bg3TnmTD66/8uH4loJpkuD4= endpoint <NEW-IP>:<PORT>`
# for example.

- name: create wireguard directories
  become: true
  file:
    path: '{{ item | dirname }}'
    owner: root
    group: systemd-network
    mode: '0644'
    state: directory
  loop:
    - '{{ vpn_private_key_path }}'
    - '{{ vpn_public_key_path }}'

- name: copy wireguard credentials
  become: true
  copy:
    src: '{{ item.src }}'
    dest: '{{ item.dest }}'
    owner: root
    group: systemd-network
    mode: '0640'
  loop:
    - {
        dest: '{{ vpn_public_key_path }}',
        src: 'files/{{ platform }}/wireguard/{{ platform }}.pub',
      }
    - {
        dest: '{{ vpn_private_key_path }}',
        src: 'files/{{ platform }}/wireguard/{{ platform }}.key',
      }

- name: copy wireguard preshared keys
  become: true
  copy:
    src: '{{ item.preshared_key_source_path }}'
    dest: '{{ item.preshared_key_path }}'
    owner: root
    group: systemd-network
    mode: '0640'
  loop: '{{ vpn_peers }}'

- block:
    - name: setup desktop network configuration
      become: true
      template:
        src: '{{ item.src }}'
        dest: '{{ item.dest }}'
        owner: root
        group: systemd-network
        mode: '0640'
      loop:
        - {
            src: 'templates/desktop/network/enp.network.j2',
            dest: '/etc/systemd/network/20-wired.network',
          }
        - {
            src: 'templates/desktop/network/wg0.network.j2',
            dest: '/etc/systemd/network/40-wg0.network',
          }
        - {
            src: 'templates/desktop/network/wg0.netdev.j2',
            dest: '/etc/systemd/network/40-wg0.netdev',
          }
    - name: remove leftover configuration files
      become: true
      file:
        path: '{{ item }}'
        state: absent
      loop:
        - '/etc/systemd/network/30-vmbr0.network'
        - '/etc/systemd/network/30-vmbr0.netdev'

  notify:
    - restart systemd-networkd
    - restart systemd-resolved
  when: platform == "desktop"

- block:
    - name: setup laptop network configuration
      become: true
      template:
        src: '{{ item.src }}'
        dest: '{{ item.dest }}'
        owner: root
        group: systemd-network
        mode: '0640'
      loop:
        - {
            src: 'templates/laptop/network/wireless.network.j2',
            dest: '/etc/systemd/network/20-wireless.network',
          }
        - {
            src: 'templates/laptop/network/wg0.network.j2',
            dest: '/etc/systemd/network/40-wg0.network',
          }
        - {
            src: 'templates/laptop/network/wg0.netdev.j2',
            dest: '/etc/systemd/network/40-wg0.netdev',
          }

    - name: remove leftover configuration files
      become: true
      file:
        path: '{{ item }}'
        state: absent
      loop:
        - '/etc/systemd/network/30-vmbr0.network'
        - '/etc/systemd/network/30-vmbr0.netdev'

  notify:
    - restart systemd-networkd
    - restart systemd-resolved
    - restart iwd
  when: platform == "laptop"

- name: copy firewall template
  become: true
  template:
    src: 'templates/{{ platform }}/nftables.j2'
    dest: '/etc/nftables.conf'
    owner: root
    group: root
    mode: '0600'
  notify: restart nftables