roles/homelab/wireguard/tasks/peers.yml

@@ -1,27 +1,21 @@
 ---
 
-- name: "Generate private keys"
-  ansible.builtin.shell:
-    cmd: wg genkey
-  register: "peer_keys"
+- name: "Check if peer private key exist"
+  ansible.builtin.stat:
+    path: "{{ wireguard_config_dir }}/peer_{{ item.name }}_private.key"
+  register: peer_key_stat
   loop: "{{ wireguard_clients }}"
   loop_control:
     label: "{{ item.name }}"
-  args:
-    creates: "{{ wireguard_config_dir }}/peer_{{ item.name }}_private.key"
-  no_log: true
 
-- name: "Save private keys"
-  ansible.builtin.copy:
-    content: "{{ item.stdout }}"
-    dest: "{{ wireguard_config_dir }}/peer_{{ item.item.name }}_private.key"
-    owner: root
-    group: root
-    mode: "0600"
-  loop: "{{ peer_keys.results }}"
+- name: "Generate and save private key"
+  ansible.builtin.shell: |
+    wg genkey > {{ wireguard_client_config_dir }}/peer_{{ item.name }}_private.key
+    chmod 0600 {{ wireguard_client_config_dir }}/peer_{{ item.name }}_private.key
+  loop: "{{ peer_key_stat.results }}"
   loop_control:
     label: "{{ item.item.name }}"
-  when: item.change | default(false)
+  when: not item.stat.exists
   no_log: true
 
 - name: "Read all private keys"