---
- name: Set WireGuard interface name
  set_fact:
    wg_if: "wg_{{ gateway_config.lab_name }}"
    wg_port: "{{ gateway_config.wg_listen_port }}"

- name: Remove existing WireGuard interface configuration
  shell: |
    uci delete network.{{ wg_if }} 2>/dev/null || true
    uci commit network
  changed_when: true

- name: Create WireGuard interface
  shell: |
    uci set network.{{ wg_if }}=interface
    uci set network.{{ wg_if }}.proto='wireguard'
    uci set network.{{ wg_if }}.private_key='{{ gateway_config.wg_private_key }}'
    uci set network.{{ wg_if }}.listen_port='{{ wg_port }}'
    uci add_list network.{{ wg_if }}.addresses='{{ gateway_config.wg_ip }}/{{ gateway_config.wg_net | ipaddr("prefix") }}'
    uci commit network
  changed_when: true

- name: Remove existing WireGuard peers
  shell: |
    for peer in $(uci show network | grep "={{ wg_if }}_peer" | cut -d. -f2 | cut -d= -f1); do
      uci delete network.$peer
    done
    uci commit network
  changed_when: true
  ignore_errors: yes

- name: Configure WireGuard gateway peers
  shell: |
    peer_name="{{ wg_if }}_peer{{ idx }}"
    uci set network.$peer_name=wireguard_{{ wg_if }}
    uci set network.$peer_name.public_key='{{ peer.public_key }}'
    uci set network.$peer_name.endpoint_host='{{ peer.endpoint }}'
    uci set network.$peer_name.endpoint_port='{{ wg_port }}'
    uci set network.$peer_name.persistent_keepalive='25'
    uci add_list network.$peer_name.allowed_ips='{{ peer.wg_ip }}/32'
    uci set network.$peer_name.route_allowed_ips='0'
    uci commit network
  loop: "{{ gateway_config.peers }}"
  loop_control:
    index_var: idx
    loop_var: peer
    label: "{{ peer.to }}"
  changed_when: true

- name: Configure WireGuard road warrior peers
  shell: |
    peer_name="{{ wg_if }}_rw{{ idx }}"
    uci set network.$peer_name=wireguard_{{ wg_if }}
    uci set network.$peer_name.public_key='{{ client.public_key }}'
    uci add_list network.$peer_name.allowed_ips='{{ client.wg_ip }}/32'
    uci set network.$peer_name.route_allowed_ips='0'
    uci set network.$peer_name.description='{{ client.email }}'
    uci commit network
  loop: "{{ gateway_config.rw_clients }}"
  loop_control:
    index_var: idx
    loop_var: client
    label: "{{ client.email }}"
  when: gateway_config.road_warrior and gateway_config.rw_clients | length > 0
  changed_when: true

- name: Reload network configuration
  shell: /etc/init.d/network reload
  changed_when: true

- name: Wait for WireGuard interface to come up
  shell: ip link show {{ wg_if }}
  register: wg_link_check
  retries: 10
  delay: 2
  until: wg_link_check.rc == 0
  changed_when: false

- name: Verify WireGuard is running
  shell: wg show {{ wg_if }}
  register: wg_status
  changed_when: false

- name: Display WireGuard status
  debug:
    var: wg_status.stdout_lines