---
# Part of role: pia-gateway
# Handlers fire in the order listed here (not the order notified):
#   1. systemd daemon reload must stay first so unit-file content changes
#      are picked up before any restart handler below acts on them.
#   2. "Reload ufw" must come before "Restart pia-killswitch" — a UFW
#      reload rebuilds ufw's own chains and, depending on how it's
#      triggered, can in principle disturb rules inserted directly into
#      the base FORWARD chain (our position-1 jump to
#      {{ pia_iptables_chain }}) outside ufw's own bookkeeping. Restarting
#      pia-killswitch immediately after re-establishes that jump and the
#      chain's contents idempotently, closing the window rather than
#      leaving it open until the next reboot. This only protects against
#      ufw reloads that happen *through this Ansible run* (i.e., a task
#      here notifies both) — a `ufw reload` run manually and separately,
#      outside of Ansible entirely, is not something a handler can react
#      to; that residual gap is closed only by every real boot re-running
#      pia-killswitch.service fresh (WantedBy=multi-user.target).
#   3. "Restart pia-killswitch" must come before "Restart pia-wg" — if
#      both fire together (e.g. pia-wg's config changed AND the
#      killswitch script changed in the same run), pia-wg's own PostUp
#      needs to run last so its "open" route is the final word, not
#      killswitch's route-table seeding.

- name: Reload systemd daemon
  ansible.builtin.systemd:
    daemon_reload: true

- name: Reload ufw
  community.general.ufw:
    state: reloaded

- name: Restart pia-killswitch
  ansible.builtin.systemd:
    name: pia-killswitch.service
    state: restarted

- name: Restart pia-wg
  ansible.builtin.systemd:
    name: "wg-quick@{{ pia_wg_interface }}"
    state: restarted

- name: Restart pia-gateway-healthcheck timer
  ansible.builtin.systemd:
    name: pia-gateway-healthcheck.timer
    state: restarted