---
- name: Download Tailscale signing key
  get_url:
    url: "https://pkgs.tailscale.com/stable/debian/{{ ansible_distribution_release }}.gpg"
    dest: /usr/share/keyrings/tailscale-archive-keyring.gpg
    mode: "0644"

- name: Add Tailscale apt repository
  apt_repository:
    repo: "deb [signed-by=/usr/share/keyrings/tailscale-archive-keyring.gpg] https://pkgs.tailscale.com/stable/debian {{ ansible_distribution_release }} main"
    state: present
    filename: tailscale

- name: Install tailscale
  apt:
    name: tailscale
    state: present
    update_cache: true

- name: Enable and start tailscaled
  service:
    name: tailscaled
    state: started
    enabled: true

- name: Check current Tailscale status
  command: tailscale status --json
  register: ts_status
  changed_when: false
  failed_when: false

- name: Bring up Tailscale (skip if already authenticated)
  command: "tailscale up --authkey {{ tailscale_authkey }} {{ tailscale_up_args }}"
  when: >
    ts_status.rc != 0 or
    (ts_status.stdout | from_json).BackendState != 'Running'
  no_log: true