add darwin support

roles/wireguard/README.md

@@ -0,0 +1,18 @@
+# WireGuard
+
+Installs WireGuard and manages `wg-quick` tunnels from `wireguard_tunnels`
+(see `defaults/main.yml` for the full schema).
+
+- **Linux** — server (`server_mode: true`) or client. Server mode enables
+  masquerade + UFW rules; tunnels are managed by `wg-quick@<iface>.service`.
+- **macOS (Darwin)** — client only, via Homebrew `wireguard-tools` +
+  `wireguard-go`. No systemd/UFW/sysctl: the config is rendered to
+  `{{ wireguard_config_base_path }}` (`/etc/wireguard`) and brought up with
+  `wg-quick`.
+
+## Verify
+
+```sh
+sudo wg show                      # Linux
+sudo /opt/homebrew/bin/wg show    # macOS (or add /opt/homebrew/bin to sudo secure_path)
+```