---
- name: Enable WireGuard
  oxlorg.opnsense.wireguard_general:
    firewall: "{{ opnsense_firewall }}"
    api_key: "{{ opnsense_api_key }}"
    api_secret: "{{ opnsense_api_secret }}"
    ssl_verify: "{{ opnsense_ssl_verify }}"
    api_port: "{{ opnsense_api_port }}"
    enabled: "{{ opnsense_wireguard_enabled }}"

- name: Configure WireGuard servers
  oxlorg.opnsense.wireguard_server:
    firewall: "{{ opnsense_firewall }}"
    api_key: "{{ opnsense_api_key }}"
    api_secret: "{{ opnsense_api_secret }}"
    ssl_verify: "{{ opnsense_ssl_verify }}"
    api_port: "{{ opnsense_api_port }}"
    name: "{{ item.name }}"
    private_key: "{{ item.private_key }}"
    port: "{{ item.port | default(51820) }}"
    allowed_ips: "{{ item.allowed_ips }}"
    mtu: "{{ item.mtu | default(1420) }}"
    dns_servers: "{{ item.dns_servers | default([]) }}"
    disable_routes: "{{ item.disable_routes | default(false) }}"
    peers: "{{ item.peers | default([]) }}"
    enabled: "{{ item.enabled | default(true) }}"
    state: "{{ item.state | default('present') }}"
  loop: "{{ opnsense_wireguard_servers }}"

- name: Configure WireGuard peers
  oxlorg.opnsense.wireguard_peer:
    firewall: "{{ opnsense_firewall }}"
    api_key: "{{ opnsense_api_key }}"
    api_secret: "{{ opnsense_api_secret }}"
    ssl_verify: "{{ opnsense_ssl_verify }}"
    api_port: "{{ opnsense_api_port }}"
    name: "{{ item.name }}"
    public_key: "{{ item.public_key }}"
    psk: "{{ item.psk | default(omit) }}"
    allowed_ips: "{{ item.allowed_ips }}"
    server: "{{ item.server | default(omit) }}"
    port: "{{ item.port | default(omit) }}"
    keepalive: "{{ item.keepalive | default(omit) }}"
    servers: "{{ item.servers | default([]) }}"
    enabled: "{{ item.enabled | default(true) }}"
    state: "{{ item.state | default('present') }}"
  loop: "{{ opnsense_wireguard_peers }}"