add darwin support

roles/wireguard/defaults/main.yml

@@ -1,6 +1,20 @@
 ---
 wireguard_primary_interface: "{{ network_interfaces.0.name }}"
 wireguard_config_base_path: /etc/wireguard
+# Group owning the config dir/files. macOS has no `root` group (gid 0 is `wheel`).
+wireguard_config_group: >-
+  {{ (ansible_facts['os_family'] == 'Darwin') | ternary('wheel', 'root') }}
+# macOS: Homebrew prefix (arm64: /opt/homebrew, Intel: /usr/local). sudo's
+# secure_path omits it, so wg/wg-quick must be called by absolute path.
+wireguard_darwin_brew_prefix: /opt/homebrew
+wireguard_wg_bin: >-
+  {{ (ansible_facts['os_family'] == 'Darwin') | ternary(wireguard_darwin_brew_prefix + '/bin/wg', 'wg') }}
+wireguard_wg_quick_bin: >-
+  {{ (ansible_facts['os_family'] == 'Darwin') | ternary(wireguard_darwin_brew_prefix + '/bin/wg-quick', 'wg-quick') }}
+# wg-quick's shebang is `#!/usr/bin/env bash` and requires bash 4+, but sudo's
+# secure_path resolves `bash` to macOS's /bin/bash 3.2. Run it through
+# Homebrew's bash explicitly (wireguard-tools depends on it).
+wireguard_darwin_bash: "{{ wireguard_darwin_brew_prefix }}/bin/bash"
 # wireguard_tunnels:
 #   - interface: wg0          # required: maps to wgN interface name and config filename
 #     address: 10.0.0.1/24   # required: CIDR address for [Interface] Address
@@ -8,6 +22,9 @@ wireguard_config_base_path: /etc/wireguard
 #     dns: 10.0.0.1           # optional: DNS= line; omit to suppress
 #     server_mode: true       # optional (default: false): enables NAT masquerade + UFW rule
 #     primary_interface: eth0 # optional: overrides wireguard_primary_interface for this tunnel
+#     private_key: ...        # optional: use a fixed (e.g. vaulted) private key instead
+#                             # of generating one on the host. Recommended for clients
+#                             # whose public key is already a server's peer.
 #     peers:                   # optional: list of [Peer] entries
 #       - name: peer_name               # required: comment label
 #         public_key: ...               # required: peer's public key
@@ -18,7 +35,8 @@ wireguard_tunnels: []
 
 # OS-dependent package name
 wireguard_package_name: >-
-  {{ (ansible_facts['os_family'] == 'Archlinux') | ternary('wireguard-tools', 'wireguard') }}
+  {{ (ansible_facts['os_family'] == 'Archlinux' or ansible_facts['os_family'] == 'Darwin')
+     | ternary('wireguard-tools', 'wireguard') }}
 
 # Prometheus exporter (optional, gated by wireguard_exporter_enabled).
 # Exposes `wg show all dump` as Prometheus metrics (bytes per peer, last