---
# Stage 1: WireGuard VPN Setup
#
# This playbook must be run FIRST to establish the WireGuard VPN network.
# After this playbook completes:
# 1. WireGuard will be running on all hosts
# 2. Client configs will be generated in playbooks/wireguard-configs/
# 3. You MUST manually update inventory/hosts.yaml to use WireGuard IPs (10.20.0.x)
# 4. Then you can run playbook 02-full-deployment.yaml
#
# Usage:
#   ansible-playbook playbooks/01-wireguard-setup.yaml
#

- name: Deploy WireGuard VPN Server
  hosts: ops_servers
  become: true
  gather_facts: true

  pre_tasks:
    - name: Validate required variables
      ansible.builtin.assert:
        that:
          - wireguard_network is defined
          - vpc_network is defined
          - ansible_host is defined
        fail_msg: "Required network variables are missing. Check group_vars/all/"
        success_msg: "Network variables validated successfully"

    - name: Display pre-deployment information
      ansible.builtin.debug:
        msg: |
          ========================================
          WireGuard VPN Server Deployment
          ========================================
          Target: {{ inventory_hostname }} (VPN Hub)
          WireGuard network: {{ wireguard_network }}
          VPC network: {{ vpc_network }}

          This will deploy WireGuard VPN server and generate client configs.
          ========================================

  roles:
    - role: wireguard

- name: Post-deployment verification
  hosts: localhost
  gather_facts: false
  tasks:
    - name: Display post-deployment instructions
      ansible.builtin.debug:
        msg: |
          ========================================
          WireGuard VPN Deployment Complete!
          ========================================

          Infrastructure deployed:
          ✅ asxpio-ops: WireGuard VPN Server (hub)

          Server-to-server connectivity:
          - asxpio-services is a peer too; its side is configured in ../nixos

          IMPORTANT NEXT STEPS FOR YOUR WORKSTATION:

          1. Client configurations for your machine are in:
             playbooks/wireguard-configs/asxpio-ops/

          2. Import a client config to connect your workstation:
             - Linux/Mac: sudo wg-quick up ./playbooks/wireguard-configs/asxpio-ops/<client>.conf
             - Windows: Import the .conf file in WireGuard GUI

          3. Test connectivity from your workstation:
             ping {{ asxpio_ops_wireguard_ip }}
             ping {{ asxpio_services_wireguard_ip }}

          4. After connecting to WireGuard, run Stage 2:
             ansible-playbook playbooks/02-full-deployment.yaml

          NOTE: Stage 2 automatically uses WireGuard IPs.
                No manual configuration changes needed!

          ========================================

    - name: Test WireGuard connectivity from controller
      ansible.builtin.wait_for:
        host: "{{ asxpio_ops_wireguard_ip }}"
        port: 22
        timeout: 5
        state: started
      register: wg_connectivity_test
      failed_when: false

    - name: Display connectivity test results
      ansible.builtin.debug:
        msg: |
          ========================================
          WireGuard Connectivity Test
          ========================================

          {% if wg_connectivity_test.failed %}
          ❌ Cannot reach servers via WireGuard from your workstation yet

          This is NORMAL if you haven't connected your workstation to WireGuard.

          To connect:
          1. Import client config: playbooks/wireguard-configs/asxpio-ops/<client>.conf
          2. Start WireGuard connection on your workstation
          3. Verify with: ping {{ asxpio_ops_wireguard_ip }}
          4. Run Stage 2: ansible-playbook playbooks/02-full-deployment.yaml

          {% else %}
          ✅ WireGuard is reachable from your workstation!

          Server-to-server VPN: Connected
          Workstation-to-server VPN: Connected

          You can now run Stage 2:
            ansible-playbook playbooks/02-full-deployment.yaml

          Stage 2 automatically uses WireGuard IPs - no manual configuration needed!
          {% endif %}

          ========================================