wireguard_client_remove.yml

---
- hosts: servers
  become: yes
  gather_facts: yes
  vars:
    client_name: "{{ client_name }}"
  tasks:
    - name: Validate client_name variable
      assert:
        that:
          - client_name is defined
          - client_name != ''
        fail_msg: "The 'client_name' variable must be set. Usage: make vpn-client-remove"

    - name: Check if client configuration exists
      stat:
        path: "/etc/wireguard/{{ client_name }}.conf"
      register: client_conf

    - name: Fail if client configuration does not exist
      fail:
        msg: "Client configuration for {{ client_name }} does not exist!"
      when: not client_conf.stat.exists

    - name: Remove client from WireGuard server configuration
      blockinfile:
        path: /etc/wireguard/wg0.conf
        state: absent
        marker: "# {mark} ANSIBLE MANAGED BLOCK FOR {{ client_name }}"
      register: removed_from_config

    - name: Delete client configuration file
      file:
        path: "/etc/wireguard/{{ client_name }}.conf"
        state: absent

    - name: Delete client zip file (cleanup)
      file:
        path: "/etc/wireguard/{{ client_name }}.zip"
        state: absent

    # --- Robust Reload ---
    - name: Reload WireGuard Configuration
      block:
        - name: Attempt hot reload (syncconf)
          shell: wg syncconf wg0 <(wg-quick strip wg0)
          args:
            executable: /bin/bash
          when: removed_from_config is changed

      rescue:
        - name: Fallback to hard restart
          systemd:
            name: wg-quick@wg0
            state: restarted