---
- name: Reload sysctl
  ansible.builtin.command: sysctl --system
  changed_when: true

# Restarting systemd-resolved re-reads /etc/systemd/resolved.conf.d/ and re-points the
# 127.0.0.53 stub at the new upstream list. It does NOT touch link addressing or routes,
# so the SSH/NAT session Ansible is running over is unaffected. Only fires when the
# `dns`-tagged drop-in above actually changed, so a re-run of the role is a no-op.
- name: Restart systemd-resolved
  ansible.builtin.systemd:
    name: systemd-resolved
    state: restarted