---
- name: Enabling Wireguard kernel module
  become: true
  community.general.modprobe:
    name: wireguard
    persistent: present
    state: present
- name: Enable IP forwarding
  become: true
  when: wireguard.ip_forward
  block:
    - name: Enabling IPv4 forwarding
      ansible.posix.sysctl:
        name: net.ipv4.ip_forward
        value: "1"
        sysctl_set: true
        state: present
    - name: Marking IPv4 forwarded traffic as valid
      ansible.posix.sysctl:
        name: net.ipv4.conf.all.src_valid_mark
        value: "1"
        sysctl_set: true
        state: present
    - name: Enabling IPv6 forwarding
      ansible.posix.sysctl:
        name: net.ipv6.conf.all.forwarding
        value: "1"
        sysctl_set: true
        state: present
    - name: Marking IPv6 traffic as valid
      ansible.posix.sysctl:
        name: net.ipv6.conf.all.src_valid_mark
        value: "1"
        sysctl_set: true
        state: present
- name: Preparing to allow Wireguard logging
  when: "wireguard.debug"
  block:
    - name: Creating subdirectory for system kernel debugging
      become: true
      ansible.builtin.file:
        path: /sys/kernel/debug/dynamic_debug
        recurse: true
        owner: root
        group: root
        mode: "755"
        state: directory
    - name: Enabling Wireguard system logging
      become: true
      ansible.builtin.copy:
        content: "module wireguard +p"
        dest: /sys/kernel/debug/dynamic_debug/control
        owner: root
        group: root
        mode: "644"
        force: true