ipsec phase2 cleanup

[zerwes]

ipsec phase2 tunnels removed from config are not deleted in the xml / on the remote, they require a explicit

opn_unset:
  - ipsec/phase2[uniqid="ee0e6..."]

[Jonybat]

How about adding something like this after the ipsecphase2.yml loop?

- name: "IPSec ike phase2 search configured uniqid for ikeid {{ ikeid }}"
  delegate_to: localhost
  xml:
    path: "{{ local_config_path }}"
    xpath: "/opnsense/ipsec/phase2[ikeid='{{ ikeid }}']/uniqid"
    content: text
  register: phase2ikeiduniqid_all

- name: "IPSec ike phase2 cleanup for ikeid {{ ikeid }}"
  delegate_to: localhost
  xml:
    path: "{{ local_config_path }}"
    xpath: "/opnsense/ipsec/phase2[ikeid='{{ ikeid }}' and uniqid='{{ item.uniqid }}']"
    state: absent
    pretty_print: yes
  when: item.uniqid not in ipsecphasevar.phase2
  with_items: "{{ phase2ikeiduniqid_all.matches }}"

[zerwes]

@Jonybat : thanks; yes, looks like a viable solution.
Would you like to open a PR? (would be great if you include a test for it)

[zerwes]

fixed in PR #67