fix(wireguard): reload tunnel via syncconf on config change

Config template changes were never applied to the running interface,
leaving a stale peer list after redeploy. Notify a syncconf reload so
peer edits apply without dropping active connections.

roles/wireguard/handlers/main.yml

@@ -6,3 +6,12 @@
 - name: Apply sysctl
   ansible.builtin.command: sysctl --system
   changed_when: true
+
+- name: Reload wireguard tunnel
+  ansible.builtin.shell: |
+    set -o pipefail
+    wg-quick strip "{{ item.interface }}" | wg syncconf "{{ item.interface }}"
+  args:
+    executable: /bin/bash
+  loop: "{{ wireguard_tunnels }}"
+  changed_when: true

roles/wireguard/tasks/tunnel.yml

@@ -43,6 +43,7 @@
     owner: root
     group: root
     mode: "0600"
+  notify: Reload wireguard tunnel
 
 - name: "Create systemd override directory for wg-quick@{{ _tunnel.interface }}"
   ansible.builtin.file: