---
- name: Добавить таблицу маршрутизации в rt_tables
  ansible.builtin.lineinfile:
    path: /etc/iproute2/rt_tables
    line: "{{ policy_routing_table_id }}\t{{ policy_routing_table_name }}"
    regexp: "^{{ policy_routing_table_id }}\\s"
    owner: root
    group: root
    mode: "0644"
    create: true

- name: Установить rp_filter в loose mode
  ansible.posix.sysctl:
    name: "{{ item }}"
    value: "{{ policy_routing_rp_filter_mode }}"
    sysctl_file: /etc/sysctl.d/50-policy-routing.conf
    reload: true
  loop:
    - net.ipv4.conf.all.rp_filter
    - net.ipv4.conf.default.rp_filter

- name: Установить/обновить systemd unit policy-routing
  ansible.builtin.template:
    src: policy-routing.service.j2
    dest: /etc/systemd/system/policy-routing.service
    owner: root
    group: root
    mode: "0644"
  notify: Restart policy-routing

- name: Включить и запустить policy-routing
  ansible.builtin.systemd:
    name: policy-routing
    enabled: true
    state: started
    masked: false
    daemon_reload: true

# ── ECMP-режим: маркировка OUTPUT (только если policy_routing_balancers пустой) ─
- name: Маркировать исходящие DNS-ответы (ECMP-режим)
  ansible.builtin.command:
    cmd: >
      firewall-cmd --permanent --direct --add-rule
      ipv4 mangle OUTPUT 0 -p {{ item }} --sport {{ policy_routing_src_port }}
      -j MARK --set-xmark {{ policy_routing_fwmark }}
  loop: "{{ policy_routing_protocols }}"
  register: result
  changed_when: "'ALREADY_ENABLED' not in result.stderr"
  notify: Reload firewalld
  when: policy_routing_balancers | length == 0

# ── MAC-matching режим ───────────────────────────────────────────────────────
- name: MAC-matching режим
  when: policy_routing_balancers | length > 0
  block:

    - name: Добавить дополнительные таблицы маршрутизации в rt_tables
      ansible.builtin.lineinfile:
        path: /etc/iproute2/rt_tables
        line: "{{ item.table_id }}\t{{ item.table_name }}"
        regexp: "^{{ item.table_id }}\\s"
        owner: root
        group: root
        mode: "0644"
        create: true
      loop: "{{ policy_routing_balancers }}"

    - name: Удалить старое правило MARK OUTPUT (несовместимо с CONNMARK)
      ansible.builtin.command:
        cmd: >
          firewall-cmd --permanent --direct --remove-rule
          ipv4 mangle OUTPUT 0 -p {{ item }} --sport {{ policy_routing_src_port }}
          -j MARK --set-xmark {{ policy_routing_fwmark }}
      loop: "{{ policy_routing_protocols }}"
      register: remove_result
      failed_when: false
      changed_when: remove_result.rc == 0
      notify: Reload firewalld

    - name: Добавить CONNMARK PREROUTING по MAC для каждого балансировщика
      ansible.builtin.include_tasks: connmark-prerouting.yml
      loop: "{{ policy_routing_balancers }}"
      loop_control:
        loop_var: balancer

    - name: Добавить CONNMARK restore в OUTPUT (UDP)
      ansible.builtin.command:
        cmd: >
          firewall-cmd --permanent --direct --add-rule
          ipv4 mangle OUTPUT 0
          -p udp --sport {{ policy_routing_src_port }}
          -m connmark ! --mark 0
          -j CONNMARK --restore-mark
      register: result
      changed_when: "'ALREADY_ENABLED' not in result.stderr"
      notify: Reload firewalld

    - name: Добавить CONNMARK restore в OUTPUT (TCP)
      ansible.builtin.command:
        cmd: >
          firewall-cmd --permanent --direct --add-rule
          ipv4 mangle OUTPUT 0
          -p tcp --sport {{ policy_routing_src_port }}
          -m connmark ! --mark 0
          -j CONNMARK --restore-mark
      register: result
      changed_when: "'ALREADY_ENABLED' not in result.stderr"
      notify: Reload firewalld