---
- name: Install wireguard-tools
  ansible.builtin.dnf:
    name: wireguard-tools
    state: present

- name: Deploy wg0 server config
  ansible.builtin.template:
    src: wg0.conf.j2
    dest: "/etc/wireguard/{{ wireguard_interface }}.conf"
    owner: root
    group: root
    mode: '0600'
  notify: Restart wireguard

- name: Create clients config directory
  ansible.builtin.file:
    path: /etc/wireguard/clients
    state: directory
    owner: root
    group: root
    mode: '0700'

# Profils clients prêts à distribuer (fichier .conf à envoyer / QR code —
# voir admin/infra/wireguard.md)
- name: Generate client configs
  ansible.builtin.template:
    src: client.conf.j2
    dest: "/etc/wireguard/clients/{{ item.name }}.conf"
    owner: root
    group: root
    mode: '0600'
  loop: "{{ wireguard_peers }}"
  loop_control:
    label: "{{ item.name }}"
  no_log: true

- name: Enable and start wg-quick
  ansible.builtin.systemd:
    name: "wg-quick@{{ wireguard_interface }}"
    enabled: true
    state: started