From 8a3c323059c25efa0fc193fc6161787615a708e4 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Cl=C3=A9ment=20D=C3=A9siles?=
 <1536672+cdesiles@users.noreply.github.com>
Date: Thu, 27 Aug 2026 10:14:23 +0200
Subject: [PATCH] fix(wireguard): reload tunnel via syncconf on config change

Config template changes were never applied to the running interface,
leaving a stale peer list after redeploy. Notify a syncconf reload so
peer edits apply without dropping active connections.
---
 roles/wireguard/handlers/main.yml | 9 +++++++++
 roles/wireguard/tasks/tunnel.yml  | 1 +
 2 files changed, 10 insertions(+)

diff --git a/roles/wireguard/handlers/main.yml b/roles/wireguard/handlers/main.yml
index 80fb57c..c1b9c5d 100644
--- a/roles/wireguard/handlers/main.yml
+++ b/roles/wireguard/handlers/main.yml
@@ -6,3 +6,12 @@
 - name: Apply sysctl
   ansible.builtin.command: sysctl --system
   changed_when: true
+
+- name: Reload wireguard tunnel
+  ansible.builtin.shell: |
+    set -o pipefail
+    wg-quick strip "{{ item.interface }}" | wg syncconf "{{ item.interface }}"
+  args:
+    executable: /bin/bash
+  loop: "{{ wireguard_tunnels }}"
+  changed_when: true
diff --git a/roles/wireguard/tasks/tunnel.yml b/roles/wireguard/tasks/tunnel.yml
index 66f220e..340b7b5 100644
--- a/roles/wireguard/tasks/tunnel.yml
+++ b/roles/wireguard/tasks/tunnel.yml
@@ -43,6 +43,7 @@
     owner: root
     group: root
     mode: "0600"
+  notify: Reload wireguard tunnel
 
 - name: "Create systemd override directory for wg-quick@{{ _tunnel.interface }}"
   ansible.builtin.file: