---
# NOTE: Outbound NAT mode (automatic/hybrid/manual) is not available via the
# API. Set it manually once in the WebUI under Firewall → NAT → Outbound → Mode.
# Recommended: Hybrid — allows automatic rules plus the custom rules below.

- name: Configure outbound NAT rules
  oxlorg.opnsense.nat_source:
    firewall: "{{ opnsense_firewall }}"
    api_key: "{{ opnsense_api_key }}"
    api_secret: "{{ opnsense_api_secret }}"
    ssl_verify: "{{ opnsense_ssl_verify }}"
    api_port: "{{ opnsense_api_port }}"
    match_fields: "{{ item.match_fields | default(['description']) }}"
    description: "{{ item.description }}"
    sequence: "{{ item.sequence | default(1) }}"
    interface: "{{ item.interface }}"
    target: "{{ item.target }}"
    target_port: "{{ item.target_port | default(omit) }}"
    no_nat: "{{ item.no_nat | default(false) }}"
    ip_protocol: "{{ item.ip_protocol | default('inet') }}"
    protocol: "{{ item.protocol | default('any') }}"
    source_net: "{{ item.source_net | default('any') }}"
    source_port: "{{ item.source_port | default(omit) }}"
    destination_net: "{{ item.destination_net | default('any') }}"
    destination_port: "{{ item.destination_port | default(omit) }}"
    log: "{{ item.log | default(false) }}"
    enabled: "{{ item.enabled | default(true) }}"
    state: "{{ item.state | default('present') }}"
  loop: "{{ opnsense_nat_source_rules }}"