{{ ansible_managed | comment }}

[connection]
id={{ wireguard_name }}
type=wireguard
interface-name={{ wireguard_name }}
autoconnect={{ wireguard_autoconnect | ternary('true', 'false') }}

[wireguard]
private-key={{ wireguard_private_key }}
private-key-flags=0

{% if wireguard_peers is defined %}
{% for peer in wireguard_peers %}
[wireguard-peer.{{ peer.public_key }}]
{% if peer.endpoint is defined %}
endpoint={{ peer.endpoint }}
{% endif %}
{% if peer.preshared_key is defined %}
preshared-key={{ peer.preshared_key }}
preshared-key-flags=0
{% endif %}
{% if wireguard_tunnel_everything %}
allowed-ips=0.0.0.0/0;::/0;
{% elif peer.allowed_ips is defined %}
allowed-ips={{ (peer.allowed_ips | join(';')) + ';' }}
{% endif %}
{% if peer.persistent_keepalive is defined and peer.persistent_keepalive %}
persistent-keepalive=25
{% endif %}
{% endfor %}
{% endif %}

[ipv4]
address1={{ wireguard_addr4 }}
method=manual
{% if wireguard_tunnel_everything %}
dns=1.1.1.1;1.0.0.1;
dns-priority=-10
dns-search=~;
{% endif %}

[ipv6]
addr-gen-mode=stable-privacy
address1={{ wireguard_addr6 }}
method=manual
{% if wireguard_tunnel_everything %}
dns=2606:4700:4700::1111;2606:4700:4700::1001;
dns-priority=-10
dns-search=~;
{% endif %}