- name: Install Packages
  package:
    name:
      - ca-certificates
      - curl
      - gnupg

# Same keyring path the hand-installed hosts use, so the repository file is identical.
- name: Install the netbird repository keyring
  ansible.builtin.shell:
    cmd: set -o pipefail && curl -fsSL https://pkgs.netbird.io/debian/public.key | gpg --dearmor -o /usr/share/keyrings/netbird-archive-keyring.gpg
    executable: /bin/bash
    creates: /usr/share/keyrings/netbird-archive-keyring.gpg

- name: Remove one-line netbird-repository
  file:
    path: /etc/apt/sources.list.d/netbird.list
    state: absent
  register: netbird_list

- name: Add netbird-repository
  deb822_repository:
    name: netbird
    types: deb
    uris: https://pkgs.netbird.io/debian
    suites: stable
    components: main
    signed_by: /usr/share/keyrings/netbird-archive-keyring.gpg
  register: netbird_repo

- name: Update apt cache after netbird-repository change
  apt:
    update_cache: yes
  when: netbird_list.changed or netbird_repo.changed

# present, not latest: an upgrade restarts the daemon and drops the tunnels of the node.
- name: Install wireguard & netbird
  package:
    name:
      - wireguard
      - netbird
    state: present