---
- name: Rolling Update of WireGuard Lab Gateways
  hosts: lab_gateways
  serial: 1
  become: yes
  
  vars:
    health_check_retries: 10
    health_check_delay: 10
  
  pre_tasks:
    - name: Load Terraform outputs
      set_fact:
        tf_config: "{{ lookup('file', terraform_output_file) | from_json }}"
      delegate_to: localhost
      run_once: yes
    
    - name: Extract gateway-specific config
      set_fact:
        gateway_config: "{{ tf_config.gateway_config.value[inventory_hostname] }}"
  
  tasks:
    - name: Update system packages (Linux)
      apt:
        update_cache: yes
        upgrade: dist
      when: gateway_config.type == "linux"
    
    - name: Restart WireGuard
      systemd:
        name: "wg-quick@wg-{{ gateway_config.lab_name }}"
        state: restarted
      when: gateway_config.type == "linux"
    
    - name: Wait and validate
      pause:
        seconds: 30