---
- name: Validate wireguard_tunnels is defined and non-empty
  ansible.builtin.assert:
    that:
      - wireguard_tunnels is defined
      - wireguard_tunnels | length > 0
    fail_msg: |
      wireguard_tunnels must be defined with at least one tunnel.
      See roles/wireguard/defaults/main.yml for configuration instructions.
    success_msg: "wireguard_tunnels validation passed"

- name: Install wireguard
  ansible.builtin.package:
    name: "{{ wireguard_package_name }}"
    state: present

- name: Install nftables (Arch server_mode PostUp dependency)
  ansible.builtin.package:
    name: nftables
    state: present
  when:
    - ansible_facts['os_family'] == 'Archlinux'
    - wireguard_tunnels | selectattr('server_mode', 'defined') | selectattr('server_mode', 'equalto', true) | list | length > 0

# Use systemd-resolved for DNS management (modern approach on all distributions)
# wg-quick calls `resolvconf` (not resolvectl) to apply DNS, so the
# systemd-resolvconf compat wrapper must be installed wherever wg-quick is
# used to push DNS to the local host. On Arch, tunnels that need this should
# set `dns:` and install openresolv/systemd-resolvconf explicitly.
- name: Install systemd-resolvconf (provides resolvconf wrapper for wg-quick)
  ansible.builtin.package:
    name: systemd-resolvconf
    state: present
  when: ansible_facts['os_family'] == 'Debian'

- name: Ensure systemd-resolved is enabled and started
  ansible.builtin.systemd:
    name: systemd-resolved
    enabled: true
    state: started

- name: Ensure wireguard configuration is only owned by root
  ansible.builtin.file:
    path: "{{ wireguard_config_base_path }}"
    owner: root
    group: root
    mode: "0700"
    recurse: true

- name: Configure tunnel
  ansible.builtin.include_tasks: tunnel.yml
  loop: "{{ wireguard_tunnels }}"
  loop_control:
    loop_var: _tunnel

- name: Deploy Prometheus wireguard exporter
  ansible.builtin.include_tasks: exporter.yml
  when: wireguard_exporter_enabled | bool