---
# Part of role: pia-gateway
# Included by: tasks/main.yaml
# Description: Registers the dedicated PIA policy-routing table and
#   installs+enables the boot-time kill-switch service that seeds it
#   (rule, terminal unreachable route, static drop rule) before
#   wg-quick@{{ pia_wg_interface }} is allowed to start. See
#   templates/pia-killswitch.sh.j2 for what the seeded state actually is.

- name: Register the PIA routing table name
  ansible.builtin.lineinfile:
    path: /etc/iproute2/rt_tables
    line: "{{ pia_route_table_id }}\t{{ pia_route_table_name }}"
    regexp: "^[0-9]+\\s+{{ pia_route_table_name }}$"
    create: true
    mode: "0644"

- name: Deploy the kill-switch seed script
  ansible.builtin.template:
    src: pia-killswitch.sh.j2
    dest: /usr/local/sbin/pia-killswitch.sh
    mode: "0700"
    owner: root
    group: root
  notify: Restart pia-killswitch

- name: Deploy the pia-killswitch systemd unit
  ansible.builtin.template:
    src: pia-killswitch.service.j2
    dest: /etc/systemd/system/pia-killswitch.service
    mode: "0644"
    owner: root
    group: root
  notify:
    - Reload systemd daemon
    - Restart pia-killswitch

- name: Enable and start the kill-switch service now
  ansible.builtin.systemd:
    name: pia-killswitch.service
    enabled: true
    state: started