---
# Part of role: pia-gateway
# Called by: ansible/playbooks/pia-gateway.yaml
# Description: Orchestrates minisforum's PIA WireGuard egress gateway for
#   VPN VLAN 50 — registration, boot-ordered kill switch + policy routing,
#   the WireGuard interface itself, and health checks. Split into included
#   files because each stage has a distinct idempotency/ordering concern;
#   see the comment at the top of each included file.

- name: Install WireGuard tooling and iproute2
  ansible.builtin.apt:
    name:
      - wireguard
      - wireguard-tools
      - iproute2
      - python3-requests
    state: present
    update_cache: true

- name: Pin reverse-path filtering for {{ pia_wg_interface }}
  ansible.posix.sysctl:
    name: "net.ipv4.conf.{{ pia_wg_interface }}.rp_filter"
    value: "{{ pia_rp_filter_mode | string }}"
    sysctl_file: /etc/sysctl.d/60-pia-gateway.conf
    reload: false # interface does not exist yet on a first run; applied for real after the WG interface comes up (handlers/main.yaml)
  register: pia_rp_filter_pinned

- name: Confirm host default route and ip_forward are untouched
  ansible.builtin.include_tasks: assert-baseline.yaml

- name: Register minisforum with PIA and obtain WireGuard peer config
  ansible.builtin.include_tasks: register.yaml
  no_log: true # PIA credentials and the derived private key pass through this include

- name: Configure boot-ordered kill switch and policy routing
  ansible.builtin.include_tasks: routing.yaml

- name: Configure firewall-layer kill switch and Technitium access
  ansible.builtin.include_tasks: firewall.yaml

- name: Write and enable the pia-wg WireGuard interface
  ansible.builtin.include_tasks: interface.yaml

- name: Install gateway health checks
  ansible.builtin.include_tasks: healthcheck.yaml

- name: Re-apply rp_filter now that {{ pia_wg_interface }} exists
  ansible.posix.sysctl:
    name: "net.ipv4.conf.{{ pia_wg_interface }}.rp_filter"
    value: "{{ pia_rp_filter_mode | string }}"
    sysctl_file: /etc/sysctl.d/60-pia-gateway.conf
    reload: true
  when: pia_rp_filter_pinned is succeeded