---
# 0. サービス利用前提の構築
- name: Deploy config file for flush table
  ansible.builtin.copy:
    src: nftables_flush.conf
    dest: /etc/nftables_flush.conf
    owner: root
    group: root
    mode: '0750'

- name: Ensure systemd override directory exists for nftables.service
  ansible.builtin.file:
    path: /etc/systemd/system/nftables.service.d
    state: directory
    owner: root
    group: root
    mode: '0755'

- name: Deploy override file for nftables.service
  ansible.builtin.copy:
    src: nftables.service.d/override.conf
    dest: /etc/systemd/system/nftables.service.d/override.conf
    owner: root
    group: root
    mode: '0644'
  register: nft_override

- name: Reload systemd daemon if override changed
  ansible.builtin.systemd_service:
    daemon_reload: true
  when: nft_override.changed

# 1. 【変更前】現在の実機の ruleset を取得してローカルに保存
- name: Get live nftables ruleset before deployment
  ansible.builtin.command: nft list ruleset
  register: nft_ruleset_before
  changed_when: false

- name: Save before ruleset to local directory
  ansible.builtin.copy:
    content: "{{ nft_ruleset_before.stdout }}\n"
    dest: "{{ fetch_dir }}/{{ inventory_hostname }}_nftables.conf.before"
    mode: '0644'
  delegate_to: localhost
  become: false  # ローカルPC側での書き込みなのでbecomeは不要
  changed_when: false

# 2. 通常のデプロイ・構文チェック・リロード処理
- name: Deploy nftables.conf to production router
  ansible.builtin.template:
    src: "{{ nftables_template_src }}"
    dest: /etc/nftables.conf
    owner: root
    group: root
    mode: '0750'
    trim_blocks: true
    lstrip_blocks: true
  register: nft_config

- name: Run syntax check on the remote router
  ansible.builtin.command: nft -c -f /etc/nftables.conf
  changed_when: false
  when: nft_config.changed  # 設定変更があった場合のみ実行

- name: Reload nftables service if configuration changed
  ansible.builtin.systemd_service:
    name: nftables
    state: reloaded
  when: nft_config.changed  # 設定変更があった場合のみ実行

# 3. 【変更後】新しい実機の ruleset を取得してローカルに保存
- name: Get live nftables ruleset after deployment
  ansible.builtin.command: nft list ruleset
  register: nft_ruleset_after
  changed_when: false
  when: nft_config.changed  # 設定変更があった場合のみ実行

- name: Save after ruleset to local directory
  ansible.builtin.copy:
    content: "{{ nft_ruleset_after.stdout }}\n"
    dest: "{{ fetch_dir }}/{{ inventory_hostname }}_nftables.conf.after"
    mode: '0644'
  delegate_to: localhost
  become: false  # ローカルPC側での書き込みなのでbecomeは不要
  changed_when: false
  when: nft_config.changed  # 設定変更があった場合のみ実行

# 4. 変更結果を確認するためのコマンドを表示する
- name: Show vimdiff commands for verification
  ansible.builtin.debug:
    msg: |
      {%- set cmds = [] -%}
      {%- for host in groups['routers'] -%}
        {%- if hostvars[host]['nft_config'] is defined and hostvars[host]['nft_config'].changed -%}
          {%- if cmds.append('vimdiff ' ~ fetch_dir ~ '/' ~ host ~ '_nftables.conf.before ' ~ fetch_dir ~ '/' ~ host ~ '_nftables.conf.after') -%}{%- endif -%}
        {%- endif -%}
      {%- endfor -%}
      {%- if cmds | length > 0 -%}
      You can copy and paste the following commands to review the actual rule differences:
      {% for cmd in cmds %}
      {{ cmd }}
      {% endfor %}
      {%- else -%}
      No changes were detected across all routers. No commands to review.
      {%- endif -%}
  delegate_to: localhost
  become: false
  run_once: true