---
- name: Installer nftables
  ansible.builtin.apt:
    name: nftables
    state: present

- name: Vérifier la présence du ruleset résolu (généré par make flux)
  ansible.builtin.stat:
    path: "{{ nftables_baseline_ruleset_genere }}"
  delegate_to: localhost
  become: false
  changed_when: false
  register: nftables_baseline_ruleset_stat

- name: Déployer le ruleset nftables résolu (moindre privilège, généré)
  ansible.builtin.copy:
    src: "{{ nftables_baseline_ruleset_genere }}"
    dest: /etc/nftables.conf
    owner: root
    group: root
    mode: "0644"
  notify: Reload nftables
  when:
    - nftables_baseline_enabled | bool
    - nftables_baseline_ruleset_stat.stat.exists

- name: Déployer la configuration nftables Set-OPS (gabarit plat — repli)
  ansible.builtin.template:
    src: nftables.conf.j2
    dest: /etc/nftables.conf
    owner: root
    group: root
    mode: "0644"
  notify: Reload nftables
  when:
    - nftables_baseline_enabled | bool
    - not nftables_baseline_ruleset_stat.stat.exists

- name: Activer nftables si demandé
  ansible.builtin.systemd:
    name: nftables
    enabled: true
    state: started
  when: nftables_baseline_enabled | bool

- name: Désactiver nftables si demandé
  ansible.builtin.systemd:
    name: nftables
    enabled: false
    state: stopped
  when: not (nftables_baseline_enabled | bool)
  failed_when: false