- name: generate hosts keys
  ansible.builtin.shell: |
    set -o pipefail
    ls "{{ wireguard_local_dir }}/{{ item }}.keys" && exit 0
    umask 077
    wg genkey | \
    tee "{{ item }}.keys" | \
    wg pubkey >> "{{ item }}.keys"
    exit 2
  args:
    chdir: "{{ wireguard_local_dir }}"
  loop: "{{ groups.all }}"
  run_once: true
  delegate_to: localhost
  register: result
  changed_when: result.rc == 2
  failed_when: result.rc not in [0, 2]