#SPDX-License-Identifier: MIT-0
#
# OPNsense role — manages OPNsense via oxlorg.opnsense REST API (no SSH)
# Collection: oxlorg.opnsense, tested with OPNsense 26.1.2
#
# Inventory: opnsense file, ansible_connection=local (API-based, no SSH)
# Playbook:  opnsense.yml
#
# DNS:  Unbound (independent resolver, selective forwards supported)
# DHCP: Kea (dnsmasq disabled)
# VPN:  WireGuard + OpenVPN clients
#
# Known API limitations in OPNsense 26.1.2 — must be set manually in WebUI:
#   - System general settings (hostname, timezone, DNS)
#   - Interface assignment and IP configuration
#   - Outbound NAT mode (set to Hybrid manually)
#   - Config backup restore
#   - OpenVPN custom options (ncp-disable, tls-cipher, etc.)
#   - CA and client certificates (System → Trust)
#
# Firewall design:
#   - LAN:   full access
#   - GUEST: DNS to OPNsense, internet only, isolated from other VLANs
#   - IoT:   DNS to OPNsense, internet only for hosts in iot_internet_allowed alias
#   - DMZ:   DNS to OPNsense, internet access, isolated from LAN/GUEST/IoT
#
---
- name: Configure OPNsense system settings
  ansible.builtin.import_tasks: system.yml
  tags: [opnsense-system]

- name: Configure OPNsense interfaces
  ansible.builtin.import_tasks: interfaces.yml
  tags: [opnsense-interfaces]

- name: Configure OPNsense default firewall rules
  ansible.builtin.import_tasks: firewall-defaults.yml
  tags: [opnsense-firewall-defaults, opnsense-firewall]

- name: Configure OPNsense firewall aliases
  ansible.builtin.import_tasks: firewall-aliases.yml
  tags: [opnsense-aliases, opnsense-firewall]

- name: Configure OPNsense firewall rules
  ansible.builtin.import_tasks: firewall-rules.yml
  tags: [opnsense-rules, opnsense-firewall]

- name: Configure OPNsense NAT
  ansible.builtin.import_tasks: nat.yml
  tags: [opnsense-nat, opnsense-firewall]

- name: Configure OPNsense DHCP
  ansible.builtin.import_tasks: dhcp.yml
  tags: [opnsense-dhcp]

- name: Configure OPNsense Unbound DNS
  ansible.builtin.import_tasks: unbound.yml
  tags: [opnsense-unbound, opnsense-dns]

- name: Configure OPNsense OpenVPN clients
  ansible.builtin.import_tasks: openvpn-clients.yml
  tags: [opnsense-openvpn]

- name: Configure OPNsense WireGuard
  ansible.builtin.import_tasks: wireguard.yml
  tags: [opnsense-wireguard]