- name: Install Packages
  package:
    name:
      - ca-certificates
      - curl
      - gnupg

# Same keyring path the hand-installed hosts use, so the repository line is identical.
- name: Install the netbird repository keyring
  ansible.builtin.shell:
    cmd: set -o pipefail && curl -fsSL https://pkgs.netbird.io/debian/public.key | gpg --dearmor -o /usr/share/keyrings/netbird-archive-keyring.gpg
    executable: /bin/bash
    creates: /usr/share/keyrings/netbird-archive-keyring.gpg

- name: Add netbird-repository
  apt_repository:
    repo: "deb [signed-by=/usr/share/keyrings/netbird-archive-keyring.gpg] https://pkgs.netbird.io/debian stable main"
    state: present
    filename: netbird
    update_cache: yes

# present, not latest: an upgrade restarts the daemon and drops the tunnels of the node.
- name: Install wireguard & netbird
  package:
    name:
      - wireguard
      - netbird
    state: present