---
- name: Configure WireGuard VPN Client
  hosts: load-balancer
  become: true
  vars:
    vpn_ip: "10.0.0.12"
    vpn_private_key: "+E1pcelkLIr0x6FcOofnAWAFr6g5qHu8QHpG1sY6mG4="
    vpn_server_pubkey: "VQa6g1foaXhJgYWbwyJ9R/EAmmXg0nOnhPhbIIPLlmg="
    vpn_server_ip: "131.123.42.158"
    vpn_server_port: "51820"
    vpn_network: "10.0.0.0/24"
    vpn_private_ip: "10.0.0.1"

  tasks:
    - name: Update apt cache
      apt:
        update_cache: yes
        cache_valid_time: 3600

    - name: Install WireGuard and tools
      apt:
        name:
          - wireguard
          - wireguard-tools
        state: present

    - name: Create WireGuard config directory
      file:
        path: /etc/wireguard
        state: directory
        mode: '0700'

    - name: Create WireGuard config
      copy:
        content: |
          [Interface]
          Address = {{ vpn_ip }}/32
          ListenPort = 51821
          PrivateKey = {{ vpn_private_key }}

          [Peer]
          PublicKey = {{ vpn_server_pubkey }}
          Endpoint = {{ vpn_server_ip }}:{{ vpn_server_port }}
          AllowedIPs = {{ vpn_network }}
          PersistentKeepalive = 25
        dest: /etc/wireguard/wg0.conf
        mode: '0600'
      register: wg_config

    - name: Enable WireGuard service
      systemd:
        name: wg-quick@wg0
        enabled: yes
        state: started

    - name: Redémarrer WireGuard si la config a changé (state:started ne recharge pas seul)
      systemd:
        name: wg-quick@wg0
        state: restarted
      when: wg_config.changed

- name: Enregistrer le pair load-balancer sur le serveur VPN
  hosts: vpn-uber
  become: true
  vars:
    vpn_ip: "10.0.0.12"
    vpn_private_key: "+E1pcelkLIr0x6FcOofnAWAFr6g5qHu8QHpG1sY6mG4="

  tasks:
    # ─── Dynamic debug WireGuard ────────────────────────────────────────────
    # Le module kernel wireguard ne logge les handshakes/keepalives (utilisés
    # par les decoders/rules Wazuh) que si son dynamic debug est activé. Ce
    # flag n'est PAS persistant : il retombe à "désactivé" à chaque reboot ou
    # rechargement du module, ce qui coupe silencieusement la remontée des
    # handshakes vers Wazuh sans toucher au fonctionnement du VPN lui-même
    # (constaté : coupure du 18 au 30/07/2026 après un reboot du serveur).
    - name: Déployer le service systemd qui réactive le dynamic debug wireguard au boot
      ansible.builtin.copy:
        dest: /etc/systemd/system/wireguard-dyndbg.service
        mode: "0644"
        owner: root
        group: root
        content: |
          [Unit]
          Description=Active le dynamic debug du module kernel WireGuard (logs handshakes pour Wazuh)
          After=wg-quick@wg0.service sys-kernel-debug.mount
          Requires=wg-quick@wg0.service
          PartOf=wg-quick@wg0.service

          [Service]
          Type=oneshot
          RemainAfterExit=yes
          ExecStart=/bin/sh -c 'echo "module wireguard +p" > /sys/kernel/debug/dynamic_debug/control'

          [Install]
          WantedBy=multi-user.target
      register: dyndbg_unit
      tags: [vpn, logging]

    - name: Activer et démarrer le service wireguard-dyndbg
      ansible.builtin.systemd:
        name: wireguard-dyndbg.service
        daemon_reload: "{{ dyndbg_unit.changed }}"
        enabled: yes
        state: started
      tags: [vpn, logging]

    - name: Calculer la clé publique du client à partir de sa clé privée
      command: wg pubkey
      args:
        stdin: "{{ vpn_private_key }}"
      delegate_to: localhost
      become: false
      register: client_pubkey
      changed_when: false
      no_log: true
      tags: [vpn]

    - name: Ajouter le pair dans wg0.conf
      ansible.builtin.blockinfile:
        path: /etc/wireguard/wg0.conf
        marker: "# {mark} PEER load-balancer"
        insertafter: EOF
        block: |
          [Peer]
          PublicKey = {{ client_pubkey.stdout }}
          AllowedIPs = {{ vpn_ip }}/32
      register: peer_added
      tags: [vpn]


    - name: Appliquer la config sans couper les autres pairs
      ansible.builtin.shell: wg syncconf wg0 <(wg-quick strip wg0)
      args:
        executable: /bin/bash
      when: peer_added.changed
      tags: [vpn]

- name: Vérifier la connectivité VPN du load-balancer
  hosts: load-balancer
  become: true
  vars:
    vpn_ip: "10.0.0.12"
    vpn_private_ip: "10.0.0.1"

  tasks:
    - name: Wait for VPN connection to establish
      pause:
        seconds: 3

    - name: Check VPN connection
      command: ip addr show wg0
      register: wg_status
      changed_when: false

    - name: Test VPN connectivity
      command: ping -c 1 "{{ vpn_private_ip }}"
      register: ping_result
      ignore_errors: yes

    - name: Display VPN status
      debug:
        msg: |
          VPN Configuration Complete!
          IP Address: {{ vpn_ip }}
          WireGuard Status:
          {{ wg_status.stdout }}

          Ping result ({{ 'SUCCESS' if ping_result.rc == 0 else 'FAILED' }}):
          {{ ping_result.stdout | default('Connection test deferred') }}