---
# Part of role: pia-gateway
# Included by: tasks/main.yaml
# Description: Enables and starts the pia-wg WireGuard interface itself.
#   The config file was already written by tasks/register.yaml (only on
#   first run / forced re-registration); this task just makes sure the
#   systemd unit is enabled and running, and that pia-killswitch.service
#   (tasks/routing.yaml) has already run first — both are WantedBy
#   multi-user.target with an explicit Before= from the kill switch, so a
#   normal boot orders them correctly without help here, but a first
#   Ansible run on an already-booted host needs the same ordering applied
#   explicitly since neither unit was part of a boot transaction yet.

- name: Confirm the kill switch is active before bringing up pia-wg
  ansible.builtin.systemd:
    name: pia-killswitch.service
  register: pia_killswitch_status
  failed_when: false

- name: Assert the kill switch is active
  ansible.builtin.assert:
    that:
      - pia_killswitch_status.status.ActiveState == "active"
    fail_msg: >-
      pia-killswitch.service is not active — refusing to start
      {{ pia_wg_interface }} without the kill switch already seeded.

- name: Enable and start wg-quick@{{ pia_wg_interface }}
  ansible.builtin.systemd:
    name: "wg-quick@{{ pia_wg_interface }}"
    enabled: true
    state: started