---
# This owns the non-secret Compose declaration only. WireGuard key material
# remains under the server-local /opt/wireguard/config bind mount.
- name: Apply the reviewed WireGuard Compose hardening
  hosts: wireguard
  become: true
  gather_facts: false
  serial: 1
  vars:
    wireguard_harden_confirm: false
    wireguard_compose_candidate: "{{ compose_project_dir }}/compose.yml.candidate"
  tasks:
    - name: Require explicit WireGuard hardening confirmation
      ansible.builtin.assert:
        that:
          - wireguard_harden_confirm | bool
        fail_msg: >-
          This operation replaces the non-secret Compose declaration. Run only
          during the approved maintenance window after a rollback archive exists.

    - name: Verify that a protected pre-change archive exists
      ansible.builtin.find:
        paths: "{{ compose_project_dir }}/backups"
        patterns: 'pre-hardening-*.tar.gz'
        file_type: file
      register: wireguard_pre_hardening_archives

    - name: Require a pre-change rollback archive
      ansible.builtin.assert:
        that:
          - wireguard_pre_hardening_archives.matched | int > 0
        fail_msg: >-
          Create a protected pre-hardening archive before replacing compose.yml.

    - name: Render the candidate non-secret Compose declaration
      ansible.builtin.template:
        src: ../templates/wireguard-compose.yml.j2
        dest: "{{ wireguard_compose_candidate }}"
        owner: root
        group: root
        mode: "0644"

    - name: Validate the candidate Compose declaration
      ansible.builtin.command:
        argv:
          - docker
          - compose
          - --project-directory
          - "{{ compose_project_dir }}"
          - --file
          - "{{ wireguard_compose_candidate }}"
          - config
          - --quiet
      changed_when: false

    - name: Atomically activate the validated Compose declaration
      ansible.builtin.command:
        argv:
          - mv
          - "{{ wireguard_compose_candidate }}"
          - "{{ compose_project_dir }}/compose.yml"
      changed_when: true