---
- name: Reload sysctl
  ansible.builtin.command: sysctl --system
  changed_when: true

# Restarting systemd-resolved re-reads /etc/systemd/resolved.conf.d/ and re-points the
# 127.0.0.53 stub at the new upstream list. It does NOT touch link addressing or routes,
# so the SSH/NAT session Ansible is running over is unaffected. Only fires when the
# `dns`-tagged drop-in above actually changed, so a re-run of the role is a no-op.
- name: Restart systemd-resolved
  ansible.builtin.systemd:
    name: systemd-resolved
    state: restarted

# Masking a unit writes a symlink to /dev/null into /etc/systemd/system; the RUNNING
# systemd keeps its old view of the unit until it re-reads unit files. The mask is read
# fresh at the next boot either way, so this only exists so the running manager does not
# disagree with on-disk state in between. `daemon_reload` re-parses unit files and
# re-runs generators — it starts and stops nothing, so it cannot disturb k3s or Longhorn.
# Fires only when a mask actually changed, so a re-run of the role is silent.
- name: Reload systemd unit files
  ansible.builtin.systemd_service:
    daemon_reload: true