---
- name: ensure /etc/nftables.d exists
  ansible.builtin.file:
    path: /etc/nftables.d
    state: directory
    mode: "0755"

- name: deploy nftables rule
  ansible.builtin.copy:
    src: "{{ item }}"
    dest: "/etc/nftables.d/{{ item }}"
    mode: "0644"
  loop:
    - 10-filter.nft
    - 10-nat.nft
    - 20-vpn.nft
    - 30-proxy.nft
    - 40-sets.nft
  notify: restart nftables

- name: render forward
  ansible.builtin.template:
    src: 90-forward.nft.j2
    dest: /etc/nftables.d/90-forward.nft
    mode: "0644"
  notify: restart nftables

- name: render dstnat
  ansible.builtin.template:
    src: 90-dstnat.nft.j2
    dest: /etc/nftables.d/90-dstnat.nft
    mode: "0644"
  notify: restart nftables

- name: deploy nftables.conf
  ansible.builtin.copy:
    src: nftables.conf
    dest: /etc/nftables.conf
    mode: "0644"
    validate: "nft -c -f %s"
  notify: restart nftables