Add conf for other host not in play

handlers/main.yml

@@ -1,3 +1,19 @@
 ---
 - name: Restart WireGuard
   service: name=wg-quick@{{ wireguard_interface }} state=restarted
+
+- name: syncconf wireguard
+  ansible.builtin.shell: |
+    set -o errexit
+    set -o pipefail
+    set -o nounset
+    systemctl is-active wg-quick@{{ wireguard_interface|quote }} || systemctl start wg-quick@{{ wireguard_interface|quote }}
+    wg syncconf {{ wireguard_interface|quote }} <(wg-quick strip /etc/wireguard/{{ wireguard_interface|quote }}.conf)
+    exit 0
+  args:
+    executable: "/bin/bash"
+#  when:
+#    - not wireguard__restart_interface
+#    - not ansible_os_family == 'Darwin'
+#    - wireguard_service_enabled == "yes"
+  listen: "reconfigure wireguard"

tasks/main.yml

@@ -73,6 +73,7 @@
         owner: root
         group: root
         mode: 0644
+      notify: "reconfigure wireguard"
 
     - name: Enable Wireguard service
       service:

templates/etc/wireguard/wireguard.conf.j2

@@ -41,13 +41,15 @@ PostDown   = firewall-cmd --remove-port {{ wireguard_port }}/udp && firewall-cmd
 {% if wireguard_save_config is defined %}
 SaveConfig = {{ wireguard_save_config }}
 {% endif %}
-{% for host in ansible_play_hosts %}
-{%   if host != inventory_hostname %}
+{% for host in groups['Vpn'] | difference([inventory_hostname]) %}
+{%   if hostvars[host].wireguard_public_key is defined %}
 
 [Peer]
 # {{ host }}
 PublicKey = {{ hostvars[host].wireguard_public_key }}
+{%     if false %}
 #AllowedIPs = 0.0.0.0/0,::/0
+{%     endif %}
 {%     if hostvars[host].wireguard_allowed_ips is defined %}
 AllowedIPs = {{ hostvars[host].wireguard_address.split('/')[0] }}/32, {% for wireguard_allowed_ip in hostvars[host].wireguard_allowed_ips %}{{ wireguard_allowed_ip }}{% if not loop.last %}, {% endif %}{% endfor %}