- name: configure keys for wireguard client and server
  hosts: wireguard
  become: true

  tasks:
    - name: create wireguard directory
      ansible.builtin.file:
        path: /etc/wireguard
        state: directory
        mode: "0700"

    - name: generate server private and public keys
      shell: "wg genkey | tee /etc/wireguard/server.private.key | wg pubkey > /etc/wireguard/server.public.key"
      args:
        creates: /etc/wireguard/server.private.key
      #creates stops the command running again if the file already exists, avoiding infinite key regen

    - name: set correct permissions for private and public keys
      shell: "chmod 600 /etc/wireguard/server.private.key /etc/wireguard/server.public.key"

    - name: generate client private and public keys
      shell: "wg genkey | tee /etc/wireguard/client.private.key | wg pubkey > /etc/wireguard/client.public.key"
      args:
        creates: /etc/wireguard/client.private.key

    - name: set correct permissions for private and public keys
      shell: "chmod 600 /etc/wireguard/client.private.key /etc/wireguard/client.public.key"