- name: Validate BIRD package track
  ansible.builtin.assert:
    that:
      - bird_track in ['bird2', 'bird3']
    fail_msg: "bird_track must be either bird2 or bird3."
  when: bird_enable

- name: Install repository prerequisites
  ansible.builtin.apt:
    name:
      - apt-transport-https
      - ca-certificates
      - python3-debian
    state: present
    update_cache: true
  when: bird_enable and bird_cznic_repo_enabled

- name: Configure CZ.NIC Labs BIRD apt repository
  ansible.builtin.deb822_repository:
    name: "cznic-labs-{{ bird_track }}"
    types: deb
    uris: "{{ bird_cznic_repo_base_url }}/{{ bird_track }}"
    suites: "{{ bird_cznic_repo_distribution }}"
    components: main
    signed_by: "{{ bird_cznic_key_url }}"
    state: present
  when: bird_enable and bird_cznic_repo_enabled

- name: Update package cache after configuring CZ.NIC repository
  ansible.builtin.apt:
    update_cache: true
  when: bird_enable and bird_cznic_repo_enabled

- name: Install WireGuard tools
  ansible.builtin.apt:
    name: "{{ wireguard_package_name }}"
    state: present
  when: wireguard_enable

- name: Install selected BIRD package
  ansible.builtin.apt:
    name: "{{ bird_package_name if bird_package_version | length == 0 else bird_package_name + '=' + bird_package_version }}"
    state: present
  when: bird_enable

- name: Configure router sysctl values
  ansible.builtin.template:
    src: router-sysctl.conf.j2
    dest: /etc/sysctl.d/99-router.conf
    owner: root
    group: root
    mode: "0644"
  notify: reload_sysctl

- name: Ensure WireGuard configuration directory exists
  ansible.builtin.file:
    path: /etc/wireguard
    state: directory
    owner: root
    group: root
    mode: "0700"
  when: wireguard_enable

- name: Validate WireGuard private keys are provided
  ansible.builtin.assert:
    that:
      - >-
        (item.private_key is defined and item.private_key | length > 0)
        or
        (item.private_key_env is defined and lookup('ansible.builtin.env', item.private_key_env) | length > 0)
    fail_msg: "Private key for {{ item.name }} is missing. Set it via Ansible Vault or the matching environment lookup."
  loop: "{{ wireguard_interfaces }}"
  no_log: true
  when: wireguard_enable

- name: Configure WireGuard interfaces
  ansible.builtin.template:
    src: wg.conf.j2
    dest: "/etc/wireguard/{{ item.name }}.conf"
    owner: root
    group: root
    mode: "0600"
  loop: "{{ wireguard_interfaces }}"
  no_log: true
  notify: restart_wireguard_interfaces
  when: wireguard_enable

- name: Enable WireGuard interfaces
  ansible.builtin.systemd:
    name: "wg-quick@{{ item.name }}"
    enabled: true
    state: started
  loop: "{{ wireguard_interfaces }}"
  when: wireguard_enable

- name: Ensure BIRD log directory exists
  ansible.builtin.file:
    path: "{{ bird_log_file | dirname }}"
    state: directory
    owner: "{{ bird_run_user }}"
    group: "{{ bird_run_group }}"
    mode: "0755"
  when: bird_enable

- name: Configure BIRD environment
  ansible.builtin.template:
    src: bird-envvars.j2
    dest: "{{ bird_envvars_path }}"
    owner: root
    group: root
    mode: "0644"
  notify: restart_bird
  when: bird_enable

- name: Configure BIRD
  ansible.builtin.template:
    src: bird.conf.j2
    dest: "{{ bird_config_path }}"
    owner: root
    group: "{{ bird_run_group }}"
    mode: "0640"
    validate: "bird -p -c %s"
  notify: restart_bird
  when: bird_enable

- name: Enable BIRD service
  ansible.builtin.systemd:
    name: "{{ bird_service_name }}"
    enabled: true
    state: started
  when: bird_enable