---
- name: ensure /etc/nftables.d exists
  ansible.builtin.file:
    path: /etc/nftables.d
    state: directory
    mode: "0755"
  when: nftables_bootstrap_files | default(false)

- name: bootstrap empty config files
  ansible.builtin.copy:
    dest: "/etc/nftables.d/{{ item }}"
    content: ""
    force: false
    mode: "0644"
  loop:
    - 10-sets.nft
    - 20-sets.nft
    - 30-nat.nft
    - 40-filter.nft
    - 50-proxy.nft
    - 90-dstnat.nft
    - 90-forward.nft
    - 90-input.nft
    - 90-output.nft
    - 90-proxy-output.nft
    - 90-proxy-prerouting.nft
  when: nftables_bootstrap_files | default(false)

- name: deploy nftables rules
  ansible.builtin.copy:
    src: "{{ item }}"
    dest: "/etc/nftables.d/{{ item | basename }}"
    owner: root
    group: root
    mode: '0644'
  loop: "{{ query('ansible.builtin.fileglob', role_path + '/files/' + inventory_hostname + '/*.nft') }}"
  notify: restart nftables

- name: render nftable rules
  ansible.builtin.template:
    src: "{{ item }}"
    dest: "/etc/nftables.d/{{ item | basename | regex_replace('\\.j2$', '') }}"
    owner: root
    group: root
    mode: '0644'
  loop: "{{ query('ansible.builtin.fileglob', role_path + '/templates/' + inventory_hostname + '/*.nft.j2') }}"
  notify: restart nftables

- name: deploy nftables.conf
  ansible.builtin.template:
    src: "{{ item }}"
    dest: "/etc/{{ item | basename | regex_replace('\\.j2$', '') }}"
    owner: root
    group: root
    mode: "0644"
    validate: "nft -c -f %s"
  loop: "{{ query('ansible.builtin.fileglob', role_path + '/templates/' + inventory_hostname + '/*.conf.j2') }}"
  notify: restart nftables