- name: Update apt cache
  apt:
   update_cache: yes
- name: Install VPN package requirements
  apt:
    name: "{{ strongswan_requeriments }}"
    state: present
    install_recommends: no
- name: Insert certificates
  no_log: true
  copy:
    content: "{{ item.content }}"
    dest: "{{ item.dest }}"
    owner: root
    group: root
    mode: "{{ item.mode }}"
  loop: "{{ certificates }}"
- name: Add private key
  copy:
    content: "{{ lookup(passbolt, 'ipsec_private_key', folder_parent_id=passbolt_folder).description }}"
    dest: /etc/ipsec.d/private/key.pem
    owner: root
    group: root
    mode: u=r,g=r,o=
- name: Configure ipsec and charon
  template:
    src: "{{ item.src }}"
    dest: "{{ item.dest }}"
    owner: root
    group: root
    mode: "{{ item.mode }}"
  loop: "{{ config_ipsec_files }}"
- name: Copy Configure file
  copy:
    src: vn.conf
    dest: /etc/strongswan.d/vn.conf
    owner: root
    group: root
    mode: u=rw,g=r,o=r
- name: IP forward as a router
  sysctl:
    name: net.ipv4.ip_forward
    value: "1"
    state: present
    sysctl_set: yes
    reload: yes
- name: Add iptables rules in rules.v4 file
  blockinfile:
    path: /etc/iptables/rules.v4
    marker: "# {mark} ANSIBLE-MANAGED MANGLE CHAIN MANGED"
    block: |
      *mangle
      :PREROUTING ACCEPT [0:0]
      :INPUT ACCEPT [0:0]
      :FORWARD ACCEPT [0:0]
      :OUTPUT ACCEPT [0:0]
      :POSTROUTING ACCEPT [0:0]
      -A PREROUTING -p tcp -m policy --dir in --pol ipsec -m tcp --tcp-flags SYN,RST SYN -m tcpmss --mss 1361:1536 -j TCPMSS --set-mss 1360
      -A POSTROUTING -p tcp -m policy --dir out --pol ipsec -m tcp --tcp-flags SYN,RST SYN -m tcpmss --mss 1361:1536 -j TCPMSS --set-mss 1360    
  register: iptables
- name: Reload iptables rules
  command: netfilter-persistent reload
  when: iptables.changed