- name: Run opnsense role
  hosts: localhost
  gather_facts: false
  vars_files:
    - inventory/group_vars/opnsense.yml
  module_defaults:
    group/oxlorg.opnsense.all:
      firewall: "{{ hostvars.opnsense.ansible_host }}"
      api_key: "{{ lookup('env', 'OPNSENSE_API_KEY') }}"
      api_secret: "{{ lookup('env', 'OPNSENSE_API_SECRET') }}"
      # if you use an internal certificate:
      #   ssl_ca_file: '/etc/ssl/certs/custom/ca.crt'
      # else you COULD (but SHOULD NOT) use:
      ssl_verify: false
      api_retries: 1
  roles:
    - opnsense
  tags: [opnsense]