---
# wireguard_manage_dns: auf NetworkManager-Hosts (Pi OS) MUSS das false sein -
# resolvconf + 'DNS='-Zeile zerschiessen dort /etc/resolv.conf (NM verwaltet DNS selbst).
- name: WireGuard installieren
  apt:
    name:
      - wireguard
    state: present
    update_cache: yes

- name: resolvconf installieren (nur wenn WG das DNS verwaltet)
  apt:
    name: resolvconf
    state: present
  when: wireguard_manage_dns | default(true)

- name: WireGuard Config deployen
  copy:
    dest: /etc/wireguard/wg0.conf
    content: |
      [Interface]
      PrivateKey = {{ wireguard_private_key }}
      Address = {{ wireguard_address }}
      {% if wireguard_manage_dns | default(true) %}
      DNS = 8.8.8.8
      {% endif %}
      MTU = {{ wireguard_mtu }}

      [Peer]
      PublicKey = {{ wireguard_vps_pubkey }}
      Endpoint = {{ wireguard_endpoint }}
      AllowedIPs = {{ wireguard_allowed_ips }}
      PersistentKeepalive = {{ wireguard_persistent_keepalive }}
    mode: "0600"
  notify: restart wireguard

- name: WireGuard aktivieren und starten
  systemd:
    name: wg-quick@wg0
    enabled: true
    state: started