ansible-roles/vpn/bridge/tasks/main.yml

---
- name: "post-up nftables inet script"
  ansible.builtin.template:
    src: "./post-up-br0-inet.nft"
    dest: "/usr/local/sbin/post-up-br0-inet.nft"
    mode: 0755
  register: vpn_bridge_post_up_br0_inet_nft

- name: "post-up nftables ipv4 script"
  ansible.builtin.template:
    src: "./post-up-br0-ipv4.nft"
    dest: "/usr/local/sbin/post-up-br0-ipv4.nft"
    mode: 0755
  register: vpn_bridge_post_up_br0_ipv4_nft

- name: "configure interface"
  ansible.builtin.template:
    src: "./br0"
    dest: "/etc/network/interfaces.d/br0"
    mode: 0644
    validate: >
      bash -c
      'if ! diff %s /etc/network/interfaces.d/br0 && ip link show dev br0 ;
       then
           ifdown br0 ;
       fi'
  register: vpn_bridge_intf

- name: "restart interface"
  ansible.builtin.shell: |
    if ip link show dev br0
    then
        ifdown br0 && ifup br0
    else
        ifup br0
    fi
  when:
    vpn_bridge_post_up_br0_inet_nft.changed or
    vpn_bridge_post_up_br0_ipv4_nft.changed or
    vpn_bridge_intf.changed

- name: "pre-down nftables inet script"
  ansible.builtin.copy:
    src: "./pre-down-br0-inet.nft"
    dest: "/usr/local/sbin/pre-down-br0-inet.nft"
    mode: 0755

- name: "pre-down nftables ipv4 script"
  ansible.builtin.copy:
    src: "./pre-down-br0-ipv4.nft"
    dest: "/usr/local/sbin/pre-down-br0-ipv4.nft"
    mode: 0755