Verify WireGuard handshakes and restore Podman networking

ansible/inventory/host_vars/prometheus.yml

@@ -19,6 +19,7 @@ wireguard_overlay_enabled: true
 wireguard_address: 10.0.0.1/24
 wireguard_listen_port: 51820
 wireguard_enable_ipv4_forwarding: true
+wireguard_reload_rootful_podman_networks: true
 wireguard_peers:
   - name: atlas
     host: atlas

ansible/roles/wireguard_overlay/defaults/main.yml

@@ -10,6 +10,9 @@ wireguard_mtu: 1420
 wireguard_firewalld_zone: wireguard
 wireguard_public_firewalld_zone: public
 wireguard_enable_ipv4_forwarding: false
+wireguard_reload_rootful_podman_networks: false
+wireguard_handshake_retries: 12
+wireguard_handshake_delay: 5
 wireguard_peers: []
 wireguard_packages:
   - wireguard-tools

ansible/roles/wireguard_overlay/tasks/main.yml

@@ -132,6 +132,20 @@
         - wireguard_firewalld_zone_result is changed
         - not ansible_check_mode
 
+    - name: Restore rootful Podman networking after firewalld reload
+      ansible.builtin.command:
+        argv:
+          - podman
+          - network
+          - reload
+          - --all
+      register: wireguard_podman_network_reload
+      changed_when: wireguard_podman_network_reload.stdout_lines | length > 0
+      when:
+        - wireguard_firewalld_zone_result is changed
+        - wireguard_reload_rootful_podman_networks | bool
+        - not ansible_check_mode
+
     - name: Assign the WireGuard interface to its firewalld zone
       ansible.posix.firewalld:
         interface: "{{ wireguard_interface }}"
@@ -156,3 +170,23 @@
         state: started
         daemon_reload: true
       when: not ansible_check_mode
+
+    - name: Apply pending WireGuard handlers before verification
+      ansible.builtin.meta: flush_handlers
+      when: not ansible_check_mode
+
+    - name: Wait for every WireGuard peer handshake
+      ansible.builtin.command:
+        argv:
+          - wg
+          - show
+          - "{{ wireguard_interface }}"
+          - latest-handshakes
+      register: wireguard_latest_handshakes
+      changed_when: false
+      retries: "{{ wireguard_handshake_retries }}"
+      delay: "{{ wireguard_handshake_delay }}"
+      until:
+        - wireguard_latest_handshakes.stdout_lines | length == wireguard_peers | length
+        - wireguard_latest_handshakes.stdout_lines | select('search', '\t0$') | list | length == 0
+      when: not ansible_check_mode