---
# Part of role: pia-gateway
# Included by: tasks/main.yaml
# Description: Enables IP forwarding persistently (required for minisforum
#   to route VLAN 50 traffic at all) and asserts the host's own default
#   route is still the normal LAN gateway before any PIA-specific routing
#   is touched. This is the guard behind "never change minisforum's normal
#   default route globally" — it fails the play loudly instead of layering
#   PIA routing on top of an already-wrong baseline.

- name: Enable IP forwarding persistently
  ansible.posix.sysctl:
    name: net.ipv4.ip_forward
    value: "1"
    sysctl_set: true
    state: present
    reload: true

- name: Read current default route
  ansible.builtin.command: ip -4 route show default
  register: pia_current_default_route
  changed_when: false

- name: Assert the host default route is still the normal LAN interface
  ansible.builtin.assert:
    that:
      - pia_current_default_route.stdout is search('dev ' + pia_lan_interface)
      - not (pia_current_default_route.stdout is search('dev ' + pia_wg_interface))
    fail_msg: >-
      minisforum's default route is not via {{ pia_lan_interface }}
      ({{ pia_current_default_route.stdout }}). Refusing to continue —
      this role must never run against a host whose own default route
      has already been changed.
    success_msg: "Host default route confirmed via {{ pia_lan_interface }}"