- name: ensure protonvpn ca certificate is installed
  copy:
    src: ProtonVPN_ike_root.pem
    dest: /etc/strongswan/swanctl/x509ca/
    mode: '0644'
  notify: reload strongswan config
  tags:
  - strongswan-cacert

- name: ensure protonvpn configuration is set
  template:
    src: protonvpn.conf.j2
    dest: /etc/strongswan/swanctl/conf.d/protonvpn.conf
    mode: '0640'
  notify: reload strongswan config
  tags:
  - strongswan-config
  - protonvpn-config